LFCS 135 🐧 Monitoring — free and uptime - KandZ

⏱️ Estimated read: 9 min | |

The previous chapters covered process monitoring with top and htop, and system-wide metrics with vmstat and iostat. This chapter covers two smaller, focused commands that answer two of the most common questions: free, which reports the memory usage, and uptime, which reports the system load average and uptime. Both commands are part of the procps package, and both are included on every Linux distribution. The LFCS exam tests the field interpretation: the free command’s available metric (which is not the same as free memory), and the uptime command’s three load average values. The critical trap is that the free memory is not the memory available to processes. Linux uses the free memory for the filesystem cache, so a healthy system shows very little free memory but plenty of available memory.

Key point: The free command reports memory in kilobytes by default. The -h flag shows human-readable units (MiB, GiB), and the -m flag shows megabytes. The available field is the memory that can be allocated to a new process without swapping. The buff/cache is the memory used for the filesystem and block device cache, which is reclaimable. The uptime command shows the current time, the uptime in days/hours/minutes, the number of logged-in users, and the load average over 1, 5, and 15 minutes. The -p flag shows the uptime in a plain format.

Why `free` and `uptime` require a specific mental model

The free memory problem. The free field in the free command is the memory that is not used by anything, including the cache. A healthy Linux system uses most of its RAM for the filesystem cache, so free is often very small. This is not a problem. The memory is immediately reclaimable if a process needs it. The available field is the estimate of how much memory is available to a new application without swapping. The available includes the free memory and the reclaimable portion of the cache. The available is the metric that matters; free alone is misleading .

The cache problem. The buff/cache field is the memory used for buffer cache and page cache. The buffer cache stores raw disk blocks. The page cache stores file contents. Both are reclaimable: the kernel can evict the cached data to make room for a new process. The cache exists because reading from memory is faster than reading from disk, and the kernel uses the otherwise idle memory for this purpose. The -w flag splits the buff/cache into separate buffers and cache columns, which is useful for understanding the composition.

The load average problem. The load average is the number of processes in the runnable and uninterruptible state. The three values are the averages over 1, 5, and 15 minutes. The trend is more important than the absolute value: a 1-minute load that is much higher than the 15-minute load indicates an increasing load. The value must be compared to the number of CPU cores. A load of 4 on a 4-core system means the CPU is fully utilized. The same load on a 1-core system means the system is overloaded.

The uptime problem. The uptime is the time since the last boot. It is reset by a reboot, which includes a kernel upgrade. A system with a very high uptime has not been patched for the kernel vulnerabilities that have been fixed since the boot. The uptime -s flag shows the boot time, which is the exact timestamp of the last boot. The uptime -p flag shows the uptime in a human-readable format (“up 5 days, 2 hours, 15 minutes”).

The trade-off. The free and uptime commands are simple. They provide a quick snapshot without the interactive overhead of top or the field depth of vmstat. The free -h is the standard command for a quick memory check. The uptime is the standard command for a quick load check. The exam tests the field interpretation because the numbers are meaningless without the context.

a. The `free` command and memory fields

The free command displays the memory usage in a table. The default unit is kilobytes.

free

The output has columns: total, used, free, shared, buff/cache, and available.

Column	Meaning
`total`	Total physical memory
`used`	Memory used by processes
`free`	Memory not used by anything
`shared`	Memory used by tmpfs
`buff/cache`	Memory used for cache and buffers
`available`	Memory available for new processes

The free and available are different. The free is the completely unused memory. The available is the memory that can be allocated without swapping, which includes the free memory and the reclaimable portion of the cache. A system with 16 GB of RAM may show 500 MB free and 12 GB available; this is a healthy system, not a shortage .

The -h flag shows the values in human-readable units (KiB, MiB, GiB). The -m flag shows megabytes. The -g flag shows gigabytes. The -w flag splits buff/cache into buffers and cache.

# Human-readable units
free -h

# Split buffers and cache
free -w

# Refresh every 2 seconds, 5 times
free -s 2 -c 5

The -s flag sets the refresh interval in seconds. The -c flag sets the number of iterations. This is the continuous monitoring mode, which is useful for watching the memory pressure during a heavy operation.

b. The `uptime` command and load average

The uptime command displays the current time, the uptime, the number of logged-in users, and the load average.

uptime

The output format is:

 10:30:00 up 5 days,  2:15,  3 users,  load average: 0.50, 0.75, 1.00

The current time is 10:30:00. The uptime is 5 days, 2:15. The number of logged-in users is 3. The load average is 0.50, 0.75, 1.00 for 1, 5, and 15 minutes.

The -p flag shows the uptime in a plain format.

uptime -p
# Output: up 5 days, 2 hours, 15 minutes

The -s flag shows the boot time.

uptime -s
# Output: 2026-10-24 08:15:00

The boot time is useful for calculating the uptime and for correlating events with the boot. A system with a high load that started at the boot time indicates a problem with a startup service.

c. Combining `free` and `uptime` for a quick health check

The two commands are often used together for a quick snapshot of system health. The free -h shows the memory pressure, and the uptime shows the CPU load. Together, they answer the question: is the system under pressure?

# Quick health check
free -h
uptime

If the available memory is low and the load average is high, the system is under memory pressure. If the available memory is high and the load average is low, the system is healthy. If the available memory is high and the load average is high, the CPU is the bottleneck. If the available memory is low and the load average is low, a single process is using the memory but not the CPU.

The vmstat command provides a more detailed view. The free and uptime are the first commands to run, and vmstat is the next step if the initial snapshot shows a problem.

Complete Example Session

# ============================================
# PART 1: BASIC FREE
# ============================================

free
# Shows memory in kilobytes.

# ============================================
# PART 2: HUMAN-READABLE
# ============================================

free -h
# Shows memory in MiB/GiB.

# ============================================
# PART 3: AVAILABLE VS FREE
# ============================================

free -h
# free: 500M, available: 12G
# This is healthy: the cache is reclaimable.

# ============================================
# PART 4: SPLIT BUFFERS AND CACHE
# ============================================

free -wh
# Shows buffers and cache separately.

# ============================================
# PART 5: CONTINUOUS MONITORING
# ============================================

free -s 2 -c 5
# Five reports, two seconds apart.

# ============================================
# PART 6: BASIC UPTIME
# ============================================

uptime
# Shows time, uptime, users, load average.

# ============================================
# PART 7: PLAIN UPTIME
# ============================================

uptime -p
# Output: up 5 days, 2 hours, 15 minutes

# ============================================
# PART 8: BOOT TIME
# ============================================

uptime -s
# Output: 2026-10-24 08:15:00

# ============================================
# PART 9: QUICK HEALTH CHECK
# ============================================

free -h && uptime
# Snapshot of memory and load.

The nine parts trace the free and uptime usage: basic view, human-readable units, available versus free, split buffers, continuous monitoring, basic uptime, plain uptime, boot time, and quick health check.

Quick Reference

`free` Options

Option	Purpose
`-h`	Human-readable
`-m`	Megabytes
`-g`	Gigabytes
`-w`	Split buffers and cache
`-s <sec>`	Refresh interval
`-c <count>`	Number of reports
`-t`	Show totals

`free` Columns

Column	Meaning
`total`	Total physical memory
`used`	Memory used by processes
`free`	Completely unused
`shared`	tmpfs
`buff/cache`	Filesystem cache
`available`	Allocatable without swapping

`uptime` Options

Option	Purpose
`-p`	Human-readable uptime
`-s`	Boot time
`-h`	Help

Load Average Interpretation

Value	Meaning
0.00	Idle
1.00	One core fully utilized
N.00	N cores fully utilized
Above N	Overloaded (N = CPU count)

Best Practices

✅ Do This:

free -h
<!-- Use human-readable units -->                    # ✅

free -w
<!-- Split buffers and cache for clarity -->        # ✅

uptime -s
<!-- Get the exact boot time -->                     # ✅

❌ Don’t Do This:

# Confuse free with available
<!-- Free includes cache, which is reclaimable -->   # ❌

# Interpret load average without CPU count
<!-- Load must be compared to core count -->         # ❌

# Assume high uptime means healthy
<!-- Kernel updates require reboot -->               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Alarm about low free memory	Cache uses the memory	Check `available`
Load average seems high	Not compared to CPU count	Check `nproc`
Boot time mismatch	Timezone difference	Use `uptime -s`
`free` shows 0 available	Real memory pressure	Check `vmstat`
Uptime not accurate	System suspended	Check kernel logs

Real-World Examples

1. Basic Free

free

2. Human-Readable

free -h

3. Split Buffers

free -w

4. Continuous Monitoring

free -s 2 -c 5

5. Total Memory

free -t

6. Basic Uptime

uptime

7. Plain Uptime

uptime -p

8. Boot Time

uptime -s

9. CPU Count

nproc

10. Quick Check

free -h && uptime

Visual

`free` Layout

┌──────────────────────────────────────────────┐
│               total   used   free   shared    │
│  Mem:        15800   5000   2000   200       │
│                                              │
│               buff/cache   available         │
│               8800        9000               │
│                                              │
│  Swap:       2048    0      2048             │
└──────────────────────────────────────────────┘

Load Average vs CPU Count

┌──────────────────────────────────────────────┐
│  Load average = 4.0                          │
│  nproc = 4                                   │
│  → 1.0 per core (fully utilized)             │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Load average = 4.0                          │
│  nproc = 1                                   │
│  → 4.0 per core (overloaded)                 │
└──────────────────────────────────────────────┘

Summary

Item	Value
Memory report	`free`
Human-readable	`free -h`
Key metric	`available`, not `free`
Cache	`buff/cache`, reclaimable
Uptime	`uptime`
Load average	1, 5, 15 minutes
Plain uptime	`uptime -p`
Boot time	`uptime -s`
CPU count	`nproc`

Key takeaways:

The available memory is the metric that matters. The free memory is the completely unused memory, which is low on a healthy system because the kernel uses it for cache. The available includes the free memory and the reclaimable cache.
The buff/cache is reclaimable. It is not a leak or a problem. The kernel evicts the cached data when a process needs the memory. The free -w flag shows the split.
The load average must be compared to the CPU count. A load of 4 on a 4-core system is fully utilized. The same load on a 1-core system is overloaded. The nproc command shows the CPU count.
The uptime -s shows the exact boot time. It is useful for correlating events and for calculating the uptime. The uptime -p shows a human-readable format.
The free -h and uptime are the first commands for a quick health check. They answer the question: is the system under memory or CPU pressure? The vmstat and iostat are the next step for a detailed diagnosis.

Remember: free is the memory snapshot. uptime is the load snapshot. The available is the metric. The buff/cache is the reuse. The load is the backlog. The CPU count is the baseline. The exam tests the interpretation of the fields and the comparison of the load to the CPU count.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Why free and uptime require a specific mental model

a. The free command and memory fields

b. The uptime command and load average

c. Combining free and uptime for a quick health check