Introduction
In Linux, unused physical memory (RAM) is not simply left idle. Linux actively uses available memory as the Page Cache to speed up file access.
As a result, the free command may show only a small amount of free memory. In many cases, however, this does not indicate a memory shortage; it simply means that Linux is using available memory efficiently.
When an application writes data to a file, the data is not necessarily saved to disk immediately. It is first written to the Page Cache and managed as a Dirty Page, then later written back to disk through Writeback. This mechanism reduces the number of disk writes and improves overall I/O performance.
The Page Cache, Dirty Pages, and Writeback each have different roles but work together to support fast file access in Linux. Understanding them helps explain why Linux may appear to have little free memory, how file writes reach disk, and how to investigate disk I/O problems.
This article explains the role and behavior of the Page Cache, the mechanisms of Dirty Pages and Writeback, and useful troubleshooting methods with diagrams.
Page Cache
The Page Cache is a Linux mechanism that caches file data in physical memory (RAM) to speed up disk access.
Normally, reading a file requires access to storage such as an SSD or HDD. Disk access, however, is much slower than accessing physical memory.
Linux therefore stores file data that has been read once in the Page Cache. When the same data is needed again, it can be retrieved quickly from the Page Cache instead of the disk.
For example, when a web server reads HTML or image files, the data is stored in the Page Cache. Subsequent access to the same files can be served from the Page Cache without disk access, reducing response time.
The Page Cache is used not only for reads but also for writes. Data written by applications is first stored in the Page Cache and later written back to disk. This reduces disk I/O operations and improves overall system performance. The writeback mechanism is explained in more detail in the Dirty Page and Writeback section below.
The Page Cache has the following characteristics.
- Caches file data in physical memory
- Reduces disk access and speeds up reads and writes
- Reclaims unnecessary cache when memory is needed
- Applications generally do not need to be aware of the Page Cache
Linux actively uses otherwise unused physical memory as the Page Cache rather than leaving it idle. Therefore, the free command may show little free memory, but in many cases that memory is simply being used effectively for caching and does not necessarily indicate a memory shortage.
How the Page Cache Works
To understand how the Page Cache works, consider reading the same file twice.
First Access
When an application reads a file and the requested data is not in the Page Cache, Linux reads it from storage such as an SSD or HDD.
The data is delivered to the application and stored in the Page Cache at the same time.
Therefore, disk I/O occurs on the first access.
Second and Subsequent Accesses
When the same file is accessed again, Linux first checks the Page Cache.
If the required data is present, Linux retrieves it directly from the Page Cache without accessing the disk.
This enables fast file access without generating disk I/O.
Because previously read files are retained in the Page Cache, applications that repeatedly access the same data benefit the most.
Physical memory is limited, so the Page Cache cannot grow indefinitely. When memory is needed, Linux reclaims less frequently used cached pages to satisfy new memory requests.
In this way, Linux balances performance and memory efficiency by actively using available memory for caching and reclaiming it when necessary.
Dirty Pages and Writeback
When an application writes data to a file, the data is not immediately saved to disk. Linux first writes it to the Page Cache and marks the corresponding page as a Dirty Page.
A Dirty Page is a page whose contents have been modified in memory but have not yet been written to disk.
For example, when an application writes to a log file, the data is reflected in the Page Cache. At this point, the file on disk has not yet been updated; only the page in memory has changed.
This mechanism reduces the number of disk writes and improves overall system performance.
If every write immediately accessed the disk, a large amount of disk I/O would occur and performance would degrade. Writing to the Page Cache first and flushing data later enables more efficient write processing.
The Dirty Page workflow is as follows.
- The application writes to a file
- The data is stored in the Page Cache
- The page becomes a Dirty Page
- Writeback later writes the data to disk
Dirty Pages are not kept in memory indefinitely. The Linux kernel performs Writeback and writes Dirty Pages to disk.
Writeback is the process of writing Dirty Pages to disk. After the write completes, the page becomes a Clean Page and may remain in the Page Cache.
The Linux kernel performs Writeback in the background, gradually writing Dirty Pages to disk.
Because this process runs automatically in the background, applications normally do not need to manage Writeback directly.
The difference between Clean Pages and Dirty Pages is summarized below.
| Page | State |
|---|---|
| Clean Page | A page whose contents match the data on disk |
| Dirty Page | A page modified in memory but not yet written to disk |
A temporary increase in Dirty Pages is normal. However, if the amount of Dirty Pages does not decrease for a long time, Writeback may not be keeping up. In that case, check for degraded disk performance or disk I/O congestion.
By combining the Page Cache, Dirty Pages, and Writeback, Linux reduces disk I/O while maintaining high file-access performance.
How to Check the Page Cache
Linux provides several commands for checking Page Cache usage. During troubleshooting, it is important to check how much cache is being used and whether Dirty Pages are accumulating.
The following sections introduce commonly used methods.
The free Command
The free command is one of the easiest ways to check memory and cache usage.
[root@almalinux ~]# free -h
total used free shared buff/cache available
Mem: 3.6Gi 1.6Gi 2.0Gi 104Mi 285Mi 2.0Gi
Swap: 0B 0B 0B
[root@almalinux ~]#
The key field to look at here is buff/cache.
| Field | Description |
|---|---|
| used | Memory reported as used |
| free | Unused memory |
| buff/cache | Memory used for buffers and cache |
| available | Memory available for new application allocations |
Because Linux actively uses free memory for caching, a low free value does not normally indicate memory pressure if available remains sufficient.
/proc/meminfo
More detailed memory information is available in /proc/meminfo.
[root@almalinux ~]# cat /proc/meminfo
MemTotal: 3742864 kB
MemFree: 2113544 kB
MemAvailable: 2088244 kB
Buffers: 13576 kB
Cached: 261124 kB
SwapCached: 0 kB
～～
Dirty: 3488 kB
Writeback: 0 kB
AnonPages: 1168880 kB
Mapped: 145220 kB
Shmem: 107052 kB
KReclaimable: 20884 kB
Slab: 66708 kB
SReclaimable: 20884 kB
SUnreclaim: 45824 kB
KernelStack: 7192 kB
PageTables: 9008 kB
[root@almalinux ~]#The following fields are particularly useful.
| Field | Description |
|---|---|
| Cached | Memory used for the Page Cache |
| Dirty | Amount of Dirty Pages |
| Writeback | Dirty Pages currently being written back |
| Buffers | Buffers used for block-device metadata/I/O |
| MemAvailable | Memory estimated to be available for new allocations |
For example, to check Dirty Page and Writeback values, run the following command.
[root@almalinux ~]# grep -E 'Dirty|Writeback' /proc/meminfo
Dirty: 179100 kB
Writeback: 100 kB
WritebackTmp: 0 kBIn this example, about 175 MB of Dirty Pages exist, while only 100 KB is currently being written back. Linux does not write all Dirty Pages at once; background Writeback can process them gradually, so values like these may occur.
The vmstat Command
vmstat can also be used to observe memory, Swap, and I/O activity.
The following example collects vmstat output every second.
[root@almalinux ~]# vmstat 1
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
1 0 0 1428580 10652 983968 0 0 5 20 0 0 0 0 99 0 0
1 0 0 1084148 10664 1327648 0 0 0 294912 2431 1335 1 31 68 0 0
1 0 0 607424 10692 1801728 0 0 8 516760 2707 1538 1 31 66 1 0
1 0 0 237556 10700 2170156 0 0 0 368640 2346 1374 1 30 70 0 0
2 0 0 116188 10252 2312000 0 0 0 647168 3004 1566 1 38 60 2 0
1 0 0 136536 10284 2291936 0 0 4 814436 3758 1708 0 48 51 1 0
6 0 0 120328 10300 2322024 0 0 0 569516 3018 1509 0 37 40 23 0
0 0 0 136844 10324 2307372 0 0 8 438276 2200 1448 1 18 55 26 0
Key fields to check are shown below.
| Field | What to Check | Result in This Example |
|---|---|---|
| free | Free memory; it may decrease as memory is used for caching | Decreased from about 1.4 GB to about 116 MB |
| cache | Cache usage | Increased from about 984 MB to about 2.3 GB |
| si | Swap In (reading from Swap into RAM) | 0 (none) |
| so | Swap Out (moving data from RAM to Swap) | 0 (none) |
| bo | Blocks written to disk (an indicator of write activity) | Increased to a maximum of 814436 |
| wa | CPU I/O wait time | Increased to a maximum of 26% |
Troubleshooting Points
When investigating Page Cache behavior, the following points can help narrow down the cause.
| What to Check | Possible Situation |
|---|---|
| Cached is large | The Page Cache is being actively used (often normal) |
| Dirty temporarily increases | Write activity is occurring (normal behavior) |
| Dirty does not decrease for a long time | Writeback may not be keeping up |
| Writeback remains high | Disk I/O may be a bottleneck |
| si and so continue to increase | Frequent swapping may indicate physical memory pressure |
The Page Cache is a mechanism Linux actively uses to improve performance. Therefore, a large Page Cache is not itself a problem. The important point is to evaluate Dirty Pages and Writeback together with disk I/O and Swap activity to understand the overall system state.
Summary
Linux speeds up disk access by actively using available memory as the Page Cache. For writes, modified data is temporarily held in memory as Dirty Pages and later written to disk through Writeback, improving disk I/O efficiency.
The roles of these mechanisms are summarized below.
| Mechanism | Role |
|---|---|
| Page Cache | Caches file data to speed up disk access |
| Dirty Page | A modified page that has not yet been written to disk |
| Writeback | The process of writing Dirty Pages back to disk |
| Swap | Moves less-used anonymous pages to disk to free physical memory |
During troubleshooting, commands such as free, /proc/meminfo, and vmstat can be used to inspect the Page Cache, Dirty Pages, and Writeback. Interpreting these values correctly helps isolate memory-pressure and disk-I/O problems efficiently.
If you’d like to learn more about Linux memory management, I’ve covered the topic in detail in the following book. Please check it out if you’re interested.
Learn How Linux Works Through Visual Explanations
This book explains how Linux memory management works through clear, visual illustrations, making the concepts easy to understand even for beginners.
English 
Japanese
コメント