Linux: What application is using my ram cache

I am wondering if I can see which application is using my ram buffer and cache. Also is there any time specified in kernel, when data is dropped from cache. My Ram is being full used by buffer and cache and it starts eating swap too.

Output of free -m:

$ free -m 
             total       used       free     shared    buffers     cached
Mem:         14034      13878        156          0         10      11362
-/+ buffers/cache:       2505      11528
Swap:         8187        478       7709

Solution 1:

No, it doesn't eat swap. It serves only as a block cache. It most cache, cache can't go out into swap, but some exceptions are existing for this rule, too. For example, caching a slow hard disk on a fast SSD could be a good thing.

But, in your case, the situation is much more simple: Linux (and any other OS) uses all (or nearly all) of the free ram to caching hard disk. And, no, it is not a problem, because if a new memory page is needed, a read cache page can be always made free. And using as many block cache as it is possible, makes the mean file operation speed better.

Actually, if you want to know the real free memory of your system, you should calculate the "buffers" and "cache" as if it were free.

What you can read on the "free" title, is actually the (mostly very minimal) memory size, which isn't (couldn't been) used even for cache. It is not a problem, and if your system is slow, it is not because of that.

The cause of your swap usage: some memory block, which seem for the kernel very unused, can be fully swapped out. These are especially the memory regions of different daemons, which only stay in the ram and don't do anything. Swapping out their memory is not a problem, because they aren't used for anything, but using their now-free ram pages for cache can make your system more fast.

What process uses the cache? It is actually hard to find out, practically impossible. The block cache isn't filled by processes, it is filled by disk read operations. If a disk block is currently in the cache (which means, reading this block again doesn't need to wait for your hard disk), it means somebody read this block, but it is not registered, which process was that. If you want to know this data, you need to watch your disk read usage while it happens!

There is a tool for this, its name is blkmon. It is capable to watch the block device read (and write) operations, google is your friend (or we are waiting your next question, here or on unix SE, too).