CheckMK is graphing the numbers on the “-/+ bufferes/cache” line. This is
a common misconception of the Linux “free” command.
Linux manages memory by using any unused RAM for disk caching. The first
time you access a file the kernel will look up the information on your disk
and keep some of that information in RAM. Your access time to that file
will be slightly faster loading from RAM the next time the file is accessed
and every subsequent time until the cache information is flushed from RAM
(Ex. reboot). This is the “buffers” and “cached” values on the right side
of the “Mem:” line.
The RAM that you are thinking about, which is used by programs in user
space (Ex. init,crond,syslog), is on the “-/+ bufferes/cache” line. This
value is 2452 MB which is more in line with the amount of RAM consumed that
you are seeing in your CheckMK graph. CheckMK is also graphing the used
value on the “Swap:” line in a darker shade of green.
If you add up the values for “Mem:buffers”, “Mem:cached”, and “-/+
buffers/cache:used”, it should equal close to the number in the “Mem:used”
entry. This is the total amount of RAM that has been mapped out for usage
by your friendly Linux kernel.