I am running slackware 13 with fvwm. I have 4gb of RAM (although the system sees less as I am using shared graphics - I don't need anything better! ) Now, when I boot up, if I run vmstat, I get about 100M RAM used and the rest free.
After starting X, that goes up to about 200/250M RAM used (which is fine).

However, after the machine has been up and running for the day and I have been doing various things (mostly just browsing and the odd bit of text editing here and there, nothing out of the ordinary), I run vmstat and it is showing 1100M of RAM in use! Now, I obviously still have plenty left to play with, but what the hell is eating up the extra 800M of ram that I had when I started up?!?

Running "top" shows nothing obvious - most processes are just marked at 0% or memory, and the odd one which isn't is less than 1%.
I am assuming therefore there is something which is leaking memory somewhere!

Is there any way to maybe trace this and see what is doing it? I have a suspicion that it may be firefox but that's just a hunch.

Cheers!

I bet if you flush the cache it will all magically reappear. RAM gets cached and to the novice (myself) appears to being all used.

Flush RAM

To free pagecache:
echo 1 > /proc/sys/vm/drop_caches

To free dentries and inodes:
echo 2 > /proc/sys/vm/drop_caches

To free pagecache, dentries and inodes:
echo 3 > /proc/sys/vm/drop_caches

Would you know it, it has all re-appeared after running the above!
So, are you saying then that it is not actually being used, it just appears to be as it is cached? Could one assume that if it was needed then the cache would be automatically flushed by the system?

Press Shift-m in top and the processes are sorted in descending order by the memory. You can see which one takes the most memory.

Install htop and that will give you a table of per-process resource consumption in a neat ncurses interface.

Look at the memory bar: there will be the green section showing memory use by the current running processes and the orange section showing the total memory use including the kernel caches.

It is odd how often this, or a variant of the confusion caused by it comes up.

It is actually being used, but it is being used as a cache for items that otherwise would have to be retrieved from disk. So, this arrangement speeds up your system overall, even if you cannot see which of your activities has caused the use.

The system only uses otherwise unused memory for this, so, essentially yes.

It might be a concern if you thought that this was going to cause your memory to wear out prematurely, but, for RAM at least, this isn't the case.

BTW, vmstat showed a 'cached' entry and a 'buff' entry, and you looked at vmstat earlier; did you notice those? And thanks to SqdnGuns for the interesting approach of 'scripting' a flush of the memory; I hadn't though of that, and it can be used to demonstrate the point.

Hi,
Thanks for that, it has cleared up a bit of confusion!

I created a little fvwmscript to display RAM usage (as I didn't like the look of any of the existing ones out there - I wanted something very simple!) which takes the output of "vmstat -s -S M" and uses it to print to a docked window.
I guess it would be worth modifying this to display the "active memory" rather than the "used memory" field? What is the "inactive memory" field representing?

Cheers