Causes and effects of tree memory usage in munin statistics

Question

System administration

Hetzner's EX4S server on CentOS 6.2 got into hands in a slightly running state
for cleaning from malware/shell and, possibly, optimizing the application. Not being a
harsh admin (website builder) - I panic and timidly spin the server.

I installed munin, I look at the memory for the third day and I'm waiting to see if
all this statistics will fall out into the disk swap soon. I also don’t understand the reason why the cache size
jumps so much during the day and what the hell does the so-called 4-7Gb unused memory do in
Linux, because. I arrive in the belief that there is no unused memory in Linux.


* a hole in the statistics - my hands restart
An elegant proposal to "get off the server and put it in the hands of a normal admin"
not accepted. Because normal ones come and go, and I need to put the
project in order and start transferring it to a new engine on the same server.

Answer 1

First, why is there unused memory - it is possible that all the files accessed by applications weigh less in total than you have free memory, so something remains unclaimed.
Why is the disk cache freed in favor of unused - maybe you have ramfs / tmpfs there and the file is deleted on it, so the memory is freed? To be honest, it's hard to guess any other version. Maybe you have unmounted the block device and the disk cache associated with it has become free?
If you think that there is a rootkit, it's probably worth reinstalling the system from scratch, so as not to risk it. It is impossible to prove the absence of a rootkit by such observation of the system.

Answer 2

So what's on it there? Similar to managed memory behavior with garbage collector (Java, .Net, etc). Memory is devoured during the operation of the software (this is not a leak), under certain conditions, garbage is collected.
I'm sorry if it's completely off topic.