By the end of this lesson you will be able to
- Explain the difference between a program and a process.
- Describe how a program moves from storage into memory and runs on the CPU.
- Explain caching and virtual memory in simple words and why they matter for speed.
- Trace the steps of opening a file and read memory figures in a system monitor.
Why does a computer with plenty of free disk space still slow down when you open too many programs? Why does a file open faster the second time? The answers lie in how memory, storage and processes cooperate. In this lesson you will follow the whole journey from a program waiting on the disk to a window on your screen, and you will learn to read the numbers that a system monitor shows.
A program and a process are not the same
A program is a set of instructions saved in a file, such as the word processor installed on your disk. It does nothing while it sits there, like a recipe in a book. A Process is a program that is running: the operating system has loaded it into memory, given it some of the CPU's time and keeps track of what it is doing. If you open the same program twice, you have one program file but two processes, just as two cooks can follow the same recipe at the same time in different kitchens. Each process has an identification number so that the system can tell them apart.
- Step 1: You open itDouble-click
- Step 2: Process createdID and permissions
- Step 3: Loaded into RAMCopied from storage
- Step 4: CPU runs itShort turns
- Step 5: Window appearsWaits for you
Read this figure as text
A flow of five steps from a program file on storage to a process running on the CPU.
A flow of five numbered steps. 1 You double-click: you ask to open a program. 2 Kernel creates a process: it gives it an ID number and checks permissions. 3 Program is copied from storage into RAM: the instructions it needs are loaded into memory. 4 CPU runs the instructions: the process gets short turns on the processor. 5 A window appears: the process draws on the screen and waits for you.
Memory and storage: the desk and the cupboard
RAM is the computer's working memory. It is very fast, but it forgets everything when the power goes off. Storage (an SSD (solid-state drive) or a Hard disk) is much larger and keeps data without power, but it is slower. Think of a desk and a filing cupboard. You keep what you are working on now on the desk, which is quick to reach but small. Everything else sits in the cupboard, big and tidy but slower to fetch. The CPU can work only with what is on the desk, so a program must be copied into RAM before it can run.
Read this figure as text
A log-scale bar chart of approximate access times for CPU cache, RAM, SSD and hard disk.
A bar chart on a logarithmic scale, with approximate typical times to fetch data. CPU cache: about 1 nanosecond. RAM: about 100 nanoseconds. SSD: about 100 microseconds, which is 100,000 nanoseconds. Hard disk: about 10 milliseconds, which is 10,000,000 nanoseconds. Each step is roughly a hundred times slower than the one above. The figures are rough and vary between devices.
Caching: keep what you will need again
Because fast storage is small and slow storage is large, computers use a trick: keep a copy of recently used data in a faster place. This is a Cache. The CPU has tiny caches built into it. The operating system also keeps recently read parts of files in spare RAM. That is why a large file opens slowly the first time and almost instantly the second: the second time the system finds it already sitting in memory. Spare RAM is not wasted when it is used as a cache. The system hands it back at once if a program needs it.
When RAM is full: virtual memory
Each process is given its own tidy-looking address space, as if it had the memory to itself. The kernel maps those addresses onto the real RAM. This is called Virtual memory, and it has two useful effects: processes cannot see or damage each other's memory, and when RAM runs short the kernel can move rarely used pieces to the disk, in an area called Swap space on Ubuntu or the page file on Windows. The programs keep running, but when the computer must fetch those pieces back from the disk, everything slows down noticeably. That is the reason a computer with too many open programs becomes sluggish and the drive light stays on.
- Programs stay in memory
- Recent files cached
- Quick switching
- Disk mostly idle
Feels fast
- Data moved to swap or page file
- Windows pause when switching
- Disk busy all the time
Close programs; consider more RAM
Read this figure as text
Two columns comparing a computer with plenty of free RAM and one with RAM full and swapping to disk.
Two columns. Plenty of free RAM: programs stay in memory, the cache holds recent files, windows switch quickly, and the disk is mostly idle. RAM full: the kernel moves rarely used data to swap or the page file on the disk, windows pause when switching, the disk is busy constantly, and the machine feels slow. The fixes are to close programs you do not need, restart a program that uses too much, and in the long run add more RAM.
Reading your own memory figures
Look at memory and processes
These steps only display information. Do not end any process that you do not recognise.
The command free -h prints memory figures in human-readable units. In the output, total is installed RAM, used is memory in use by programs, buff/cache is memory the system uses as a cache, and available estimates how much programs could use without swapping. The Swap line shows the swap area on disk. Look at available more than free, because cache can be given back.
free -h- Marker 1: Column names
- Marker 2: buff/cache and available are the key figures
- Marker 4: Swap used is 0B: not swapping
Read this figure as text
A simulated terminal showing the output of the free -h command with marks on total, buff/cache and available.
A simulated bash terminal. The command free -h prints a table. The Mem row reads: total 7.6 gigabytes, used 2.4 gigabytes, free 3.1 gigabytes, shared 180 megabytes, buff/cache 2.1 gigabytes, available 5.2 gigabytes. The Swap row reads total 2.0 gigabytes, used 0 bytes, free 2.0 gigabytes. Marker 1 points to total, marker 2 to buff/cache, marker 3 to available, and marker 4 to Swap used being zero, meaning the system is not swapping. The values are examples.
To see processes graphically, open System Monitor (search for it in Activities). The Processes tab lists what is running and how much memory each uses, and the Resources tab draws graphs of CPU, memory and swap.
Open Task Manager by pressing Ctrl+Shift+Esc. The Processes tab lists programs and how much memory each uses. Open the Performance tab and choose Memory to see how much of the installed memory is in use, how much is Cached, and how much is Available. Use End task only for a program that is frozen and that you recognise.
Memory: 16.0 GB
In use: 4.9 GB Available: 10.9 GB
Cached: 5.1 GB
Committed: 6.2 / 18.4 GB
- Marker 1: Choose Memory
- Marker 2: Committed includes the page file
- Marker 3: In use and available
Read this figure as text
A simulated window with a sidebar of CPU, Memory and Disk and text showing memory in use and available.
A simulated Task Manager window with a sidebar listing CPU, Memory, Disk and Wi-Fi, with Memory selected (marker 1). The main area shows In use 4.9 GB, Available 10.9 GB, Cached 5.1 GB, and Committed 6.2 of 18.4 GB (marker 2: the committed figure includes the page file). Marker 3 points to a button area where the tool offers tabs. The values are examples.
The whole path of opening a file
Now put everything together. You double-click report.odt. The file manager, a process, tells the kernel which program is linked to that file type. The kernel creates a process for the word processor if it is not running and loads its instructions from storage into RAM. That process then makes a system call asking the kernel to read report.odt. The kernel finds the file through the file system, asks the storage driver to fetch the data, and puts the data into RAM, keeping a copy in the cache. The word processor reads the data from memory, the CPU runs its instructions, and the window appears with your text. Opening the file a second time is faster because the data is already in the cache.
- Step 1: Double-click
- Step 2: Find the programBy file type
- Step 3: Start processLoad into RAM
- Step 4: Ask for fileSystem call
- Step 5: Read from driveKernel and driver
- Step 6: Keep in RAMCopy cached
- Step 7: Show window
Read this figure as text
A flow of seven steps showing how double-clicking a file leads to it appearing on screen.
A flow of seven numbered steps. 1 Double-click: the file manager receives the click. 2 Choose the program: the system finds which program opens this file type. 3 Start the process: the kernel creates a process and loads the program into RAM. 4 Ask for the file: the process makes a system call to read it. 5 Fetch from storage: the kernel and driver read the data from the drive. 6 Keep in RAM and cache: the data is stored in memory and a copy is cached. 7 Draw the window: the CPU runs the program and the document appears.
Common mistakes
✖ Instead of: Worrying that low free memory means the computer is failing.
✔ Do this: The system uses spare RAM as cache on purpose. Look at the available figure and whether swap is busy.
✖ Instead of: Thinking more disk space makes a computer faster when it runs out of memory.
✔ Do this: Free disk space does not add RAM. Close programs, or add RAM, to relieve a memory shortage.
✖ Instead of: Ending processes in Task Manager at random.
✔ Do this: End only a program that is frozen and that you recognise. System processes keep Windows working.
If something goes wrong
freeis not recognised on Windows.freeis a Linux command. Use Task Manager's Performance tab, then Memory, on Windows.- System Monitor does not appear in Ubuntu's Activities search.
- Try searching for monitor, or use the terminal commands
free -handtop. Pressqto leave top. Installing software is covered in the Ubuntu software lesson. - Memory use stays high after I close everything.
- Part of it is cache, which is harmless. Check the available figure. If it stays low, restart the computer and see which program rises first.
- The numbers on my machine differ from the lesson.
- That is expected. The lesson's figures are examples. What matters is how the numbers change when you open and close programs.
Key terms
- Process
- A program that is currently running, together with the memory and resources it is using.
- RAM
- The computer's short-term working space, which holds what you are using right now and is emptied when it switches off.
- Cache
- A small store of recently used data kept close by so it can be fetched again quickly.
- Virtual memory
- A way for the operating system to give each program its own tidy view of memory, and to use disk space when RAM runs short.
- Swap space
- Disk space the system uses as slow overflow when memory is full.
- Storage
- The part of a computer that keeps your files and programs even when it is switched off.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Watch memory while opening programs
Open the memory view (free -h on Ubuntu or Task Manager's Memory page on Windows) and write down the used and available figures. Open a web browser with three tabs and a document, then look again and write down the new numbers. Close the browser and look a third time. Finally, open the same large document twice, closing it in between, and notice whether the second open is faster. Write two sentences about what changed and why.
Challenge: diagnose a slow computer on paper
A friend's laptop has 4 GB of RAM and a hard disk. It becomes very slow when she opens a browser with many tabs, and the disk light is on constantly. Write a short diagnosis that explains what is probably happening using the words process, RAM, swap or page file, and cache, then list three low-cost actions in order from safest to most costly.
Knowledge check
6 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- A program is a file of instructions; a process is that program running.
- A program must be copied from storage into RAM before the CPU can run it.
- Caches keep recent data in a faster place, so repeated actions are quicker.
- Virtual memory separates processes and can use disk space when RAM is full, at a speed cost.
- Opening a file passes through the file manager, kernel, driver, storage, RAM and CPU.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Windows documentation (Microsoft)
- Ubuntu Desktop help (Canonical)
- The Linux kernel documentation (The Linux Kernel Organization)