255

I have a server with 12G of memory. A fragment of top is shown below:

PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                                                                                                                                                                      
12979 frank  20   0  206m  21m  12m S   11  0.2  26667:24 krfb                                                                                                                                                                                                                                                          
13 root      15  -5     0    0    0 S    1  0.0  36:25.04 ksoftirqd/3                                                                                                                                                                                                                                                   
59 root      15  -5     0    0    0 S    0  0.0   4:53.00 ata/2                                                                                                                                                                                                                                                         
2155 root      20   0  662m  37m 8364 S    0  0.3 338:10.25 Xorg                                                                                                                                                                                                                                                          
4560 frank  20   0  8672 1300  852 R    0  0.0   0:00.03 top                                                                                                                                                                                                                                                           
12981 frank  20   0  987m  27m  15m S    0  0.2  45:10.82 amarok                                                                                                                                                                                                                                                        
24908 frank  20   0 16648  708  548 S    0  0.0   2:08.84 wrapper                                                                                                                                                                                                                                                       
1 root      20   0  8072  608  572 S    0  0.0   0:47.36 init                                                                                                                                                                                                                                                          
2 root      15  -5     0    0    0 S    0  0.0   0:00.00 kthreadd

The free -m shows the following:

             total       used       free     shared    buffers     cached
Mem:         12038      11676        362          0        599       9745
-/+ buffers/cache:       1331      10706
Swap:         2204        257       1946

If I understand correctly, the system has only 362 MB of available memory. My question is: How can I find out which process is consuming most of the memory?

Just as background info, the system is running 64bit OpenSuse 12.

1

12 Answers 12

338

use quick tip using top command in linux/unix

$ top

and then hit Shift+m (i.e. write a capital M).

From man top

SORTING of task window
  For compatibility, this top supports most of the former top sort keys.
  Since this is primarily a service to former top users, these commands do
  not appear on any help screen.
    command   sorted-field                  supported
      A         start time (non-display)      No
      M         %MEM                          Yes
      N         PID                           Yes
      P         %CPU                          Yes
      T         TIME+                         Yes

Or alternatively: hit Shift + f , then choose the display to order by memory usage by hitting key n then press Enter. You will see active process ordered by memory usage

5
  • 75
    Or you can just press M ( Shift+ m )
    – Patryk
    Jun 12, 2013 at 15:22
  • 9
    @risnandar is there a way to show memory in MB and not %
    – codecowboy
    Feb 12, 2014 at 12:48
  • 2
    hi codecowboy, perhaps you can look at commandlinefu.com/commands/view/3/… for more detailed memory used in my server i am using third party app like newrelic.com
    – risnandar
    Feb 13, 2014 at 14:01
  • 8
    or just top -o mem -O cpu
    – skipy
    Jul 27, 2015 at 11:50
  • On Ubuntu 16 I needed top -o RES otherwise "unrecognised field name 'mem'"
    – AdamS
    Mar 5, 2017 at 11:55
290

First, repeat this mantra for a little while: "unused memory is wasted memory". The Linux kernel keeps around huge amounts of file metadata and files that were requested, until something that looks more important pushes that data out. It's why you can run:

find /home -type f -name '*.mp3'
find /home -type f -name '*.aac'

and have the second find instance run at ridiculous speed.

Linux only leaves a little bit of memory 'free' to handle spikes in memory usage without too much effort.

Second, you want to find the processes that are eating all your memory; in top use the M command to sort by memory use. Feel free to ignore the VIRT column, that just tells you how much virtual memory has been allocated, not how much memory the process is using. RES reports how much memory is resident, or currently in ram (as opposed to swapped to disk or never actually allocated in the first place, despite being requested).

But, since RES will count e.g. /lib/libc.so.6 memory once for nearly every process, it isn't exactly an awesome measure of how much memory a process is using. The SHR column reports how much memory is shared with other processes, but there is no guarantee that another process is actually sharing -- it could be sharable, just no one else wants to share.

The smem tool is designed to help users better gage just how much memory should really be blamed on each individual process. It does some clever work to figure out what is really unique, what is shared, and proportionally tallies the shared memory to the processes sharing it. smem may help you understand where your memory is going better than top will, but top is an excellent first tool.

7
  • So if only "free" column statistic drops, top shows nothing else different, we can conclude the memory is allocated by linux kernel to store file things and will give the memory to other processes when nessary?
    – Al2O3
    Jul 6, 2016 at 4:44
  • @Rubby, that's probably true; the /proc/meminfo and /proc/slabinfo files detail what the kernel is using the storage for -- the slabtop program is very much like top, but shows which of the slab allocators have allocated how much, what their ratios are like, etc.
    – sarnold
    Jul 7, 2016 at 0:29
  • Thanks for the tip on 'smem' - I want Linux to "waste" some RAM so my machine can run fast. If 'find' takes a little longer on a 2nd pass, it's ok. A stuck-mouse and frozen windows while Linux decides which RAM (which it has unnecessarily hogged), needs to be cleared and re-allocated to what I am doing NOW - or even swaps to disk - is not an option. I have 16 GB of ram on this box, and I expect several GB of that to be kept free and available to running applications.
    – JosephK
    Jul 21, 2016 at 3:59
  • 1
    @JosephK, moving a mouse has more to do with scheduling priorities and algorithms; if memory allocations are necessary to move a mouse pointer then something is seriously wrong with the software you're using. :)
    – sarnold
    Jul 21, 2016 at 18:21
  • 3
    @JosephK It actually takes the kernel less time to repurpose memory from one use to another than to put free memory into use. One requires acceessing and modifying the free list, the other doesn't. Unfortunately, this is an XY question. The problem has to do with performance and may be entirely unrelated to memory consumption (despite the evidence that making more memory free helps it, that may be for more complex reasons than the OP suspects) but instead they asked about analyzing memory usage. That gets less useful answers than asking about the actual problem. Jan 31, 2019 at 18:21
38
ps aux | awk '{print $2, $4, $11}' | sort -k2rn | head -n 10

(Adding -n numeric flag to sort command.)

1
28

First you should read an explanation on the output of free. Bottom line: you have at least 10.7 GB of memory readily usable by processes.

Then you should define what "memory usage" is for a process (it's not easy or unambiguous, trust me).

Then we might be able to help more :-)

2
  • Where did you get 10.7 from? From buffers/cache [free]? Thanks for the link, I will read it. Jan 26, 2011 at 8:39
  • 3
    Yes. The point is that most of the memory is used by buffers and cache. This memory can be "dumped" right away if any process needs more memory. When you subtract the amount of memory used for buffers/cache from the USED amount, or add it to FREE amount, you get the numbers on the second line, which then imples that only 1.3 gig is really used, or, seen from the other angle, you have 10.7 gig readily available memory (since buffers and cache can be insta-dumped on demand).
    – stolsvik
    Mar 14, 2013 at 15:32
21

List and Sort Processes by Memory Usage:

ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
1
  • 8
    Or: ps -e -orss=,args= | sort -nr | head
    – kenorb
    Oct 30, 2013 at 12:53
17

ps aux --sort '%mem'

from procps' ps (default on Ubuntu 12.04) generates output like:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
...
tomcat7   3658  0.1  3.3 1782792 124692 ?      Sl   10:12   0:25 /usr/lib/jvm/java-7-oracle/bin/java -Djava.util.logging.config.file=/var/lib/tomcat7/conf/logging.properties -D
root      1284  1.5  3.7 452692 142796 tty7    Ssl+ 10:11   3:19 /usr/bin/X -core :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
ciro      2286  0.3  3.8 1316000 143312 ?      Sl   10:11   0:49 compiz
ciro      5150  0.0  4.4 660620 168488 pts/0   Sl+  11:01   0:08 unicorn_rails worker[1] -p 3000 -E development -c config/unicorn.rb             
ciro      5147  0.0  4.5 660556 170920 pts/0   Sl+  11:01   0:08 unicorn_rails worker[0] -p 3000 -E development -c config/unicorn.rb             
ciro      5142  0.1  6.3 2581944 239408 pts/0  Sl+  11:01   0:17 sidekiq 2.17.8 gitlab [0 of 25 busy]                                                                          
ciro      2386  3.6 16.0 1752740 605372 ?      Sl   10:11   7:38 /usr/lib/firefox/firefox

So here Firefox is the top consumer with 16% of my memory.

You may also be interested in:

ps aux --sort '%cpu'
3
  • shouldn't it be -%mem and -%cpu ?
    – arif
    Jul 4, 2020 at 0:23
  • @muhammad the advantage of not having - is that the largest shows last on my terminal, so I don't have to less it. Jul 4, 2020 at 7:13
  • Cool! I usually head it. So I was a bit confused. Thanks.
    – arif
    Jul 4, 2020 at 17:46
7

Building on gaoithe's answer, I attempted to make the memory units display in megabytes, and sorted by memory descending limited to 15 entries:

ps -e -orss=,args= |awk '{print $1 " " $2 }'| awk '{tot[$2]+=$1;count[$2]++} END {for (i in tot) {print tot[i],i,count[i]}}' | sort -n | tail -n 15 | sort -nr | awk '{ hr=$1/1024; printf("%13.2fM", hr); print "\t" $2 }'

       588.03M  /usr/sbin/apache2
       275.64M  /usr/sbin/mysqld
       138.23M  vim
        97.04M  -bash
        40.96M  ssh
        34.28M  tmux
        17.48M  /opt/digitalocean/bin/do-agent
        13.42M  /lib/systemd/systemd-journald
        10.68M  /lib/systemd/systemd
        10.62M  /usr/bin/redis-server
         8.75M  awk
         7.89M  sshd:
         4.63M  /usr/sbin/sshd
         4.56M  /lib/systemd/systemd-logind
         4.01M  /usr/sbin/rsyslogd

Here's an example alias to use it in a bash config file:

    alias topmem="ps -e -orss=,args= |awk '{print \$1 \" \" \$2 }'| awk '{tot[\$2]+=\$1;count[\$2]++} END {for (i in tot) {print tot[i],i,count[i]}}' | sort -n | tail -n 15 | sort -nr | awk '{ hr=\$1/1024; printf(\"%13.2fM\", hr); print \"\t\" \$2 }'"

Then you can just type topmem on the command line.

1
  • 1
    How do I edit this to chop the output of command. So that the command string can appear nicely on the line when the command was too long. ps -eo rss,pid,user,command | sort -rn | head -$1 | awk { hr[1024**2]="GB"; hr[1024]="MB"; for (x=1024**3; x>=1024; x/=1024) { if ($1>=x) { printf ("%-6.2f %s ", $1/x, hr[x]); break } } } { printf ("%-6s %-10s ", $2, $3) } { for ( x=4 ; x<=NF ; x++ ) { printf ("%s ",$x) } print ("\n") } '
    – nyxee
    Mar 29, 2021 at 16:42
5

How to total up used memory by process name:

Sometimes even looking at the biggest single processes there is still a lot of used memory unaccounted for. To check if there are a lot of the same smaller processes using the memory you can use a command like the following which uses awk to sum up the total memory used by processes of the same name:

ps -e -orss=,args= |awk '{print $1 " " $2 }'| awk '{tot[$2]+=$1;count[$2]++} END {for (i in tot) {print tot[i],i,count[i]}}' | sort -n

e.g. output

9344 docker 1
9948 nginx: 4
22500 /usr/sbin/NetworkManager 1
24704 sleep 69
26436 /usr/sbin/sshd 15
34828 -bash 19
39268 sshd: 10
58384 /bin/su 28
59876 /bin/ksh 29
73408 /usr/bin/python 2
78176 /usr/bin/dockerd 1
134396 /bin/sh 84
5407132 bin/naughty_small_proc 1432
28061916 /usr/local/jdk/bin/java 7
3
  • Nice, any way to show memory in different units (like the -h, --human-readable flag to ls)?
    – kjones
    Aug 28, 2020 at 22:37
  • I reversed the sort, limited to 15 entries, and attempted to calculate megabytes: ps -e -orss=,args= |awk '{print $1 " " $2 }'| awk '{tot[$2]+=$1;count[$2]++} END {for (i in tot) {print tot[i],i,count[i]}}' | sort -n | tail -n 15 | sort -nr | awk '{ hr=$1/1024; printf("%13.2fM", hr); print "\t" $2 }'
    – kjones
    Aug 28, 2020 at 23:01
  • 1
    ps doesn't have a -h human-readable option and there doesn't seem to be a standard tool for conversion, numfmt seems a bit limited, awk and numfmt info here: unix.stackexchange.com/questions/44040/…
    – gaoithe
    Aug 31, 2020 at 10:30
4

you can specify which column to sort by, with following steps:

steps:
* top
* shift + F
* select a column from the list
    e.g. n means sort by memory,
* press enter
* ok
1
  • 1
    Duplicate of risnandar's answer above.
    – benjaoming
    May 18, 2015 at 12:06
4

You can see memory usage by executing this code in your terminal:

$ watch -n2 free -m
$ htop
0

This very second in time

ps -U $(whoami) -eom pid,pmem,pcpu,comm | head -n4

Continuously updating

watch -n 1 'ps -U $(whoami) -eom pid,pmem,pcpu,comm | head -n4'

I also added a few goodies here you might appreciate (or you might ignore)

-n 1 watch and update every second

-U $(whoami) To show only your processes. $(some command) evaluates now

| head -n4 To only show the header and 3 processes at a time bc often you just need high usage line items

${1-4} says my first argument $1 I want to default to 4, unless I provide it

If you are using a mac you may need to install watch first brew install watch

Alternatively you might use a function

psm(){
    watch -n 1 "ps -eom pid,pmem,pcpu,comm | head -n ${1-4}"
    # EXAMPLES: 
    # psm 
    # psm 10
}
1
  • And you can easily sort by cpu if you change -m to -r Jun 1, 2020 at 3:09
-2

You have this simple command:

$ free -h

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.