Introduction
Linux is quite popular for its command-line utilities, which not only make any task at hand easier but also saves a lot of time, which is otherwise wasted in graphical UI based utilities.
This is one of the reasons why Linux is a preferred operating system for servers and administrative machines. Combine the knowledge of Linux commands and shell scripting and you have a proper toolkit of system administration at your disposal.
You may have noticed that sometimes your system consumes too much of memory, which makes your application’s slow or unresponsive.
What do you think would be the best approach to identify the processes that are consuming more memory in a Linux machine?
So This can_be easily identified using the top command and the ps command and we will explain how to use these two commands to identify which processes are eating all the resources on your system.
Today we will see how to see the top heaviest memory and CPU resource-consuming processes in Linux.
List All Running Processes in Linux
We will explain three methods to achieve that
1-List Top Linux Processes by Memory and CPU Usage using “ps”
So The ps command has a lot of options and arguments available to display output in different formats. However, it can be simply run with the argument ‘aux’ to get a general overview of running processes.
# ps auxWe will use the argument ‘–sort’ to sort the output by memory and CPU usage.
The syntax for using the sort argument is:
# ps aux --sort <column_name>Similarly, to reverse sort the output, the following canbe used:
# ps aux --sort -<column_name>Since we want the top processes by memory and CPU usage, we will sort the output by reverse, and put these columns as the column name argument.
Find Top Running Processes by Memory Usage
$ ps aux --sort -%memFind Top Running Processes by CPU Usage
$ ps aux --sort -%cpuFinally, to limit the number of processes shown to 10, we pipe the output to the head command.
For %mem
[root@unixcop ~]# ps aux --sort -%mem | head -10
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 935 0.0 2.2 305600 42468 ? Ssl 08:40 0:01 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
root 936 0.0 2.1 229132 40776 ? S 08:40 0:00 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
root 964 0.0 1.5 416596 28384 ? Ssl 08:40 0:00 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P
apache 1056 0.0 1.4 1959764 27272 ? Sl 08:40 0:00 /usr/sbin/httpd -DFOREGROUND
polkitd 867 0.0 1.3 1631160 25108 ? Ssl 08:40 0:00 /usr/lib/polkit-1/polkitd --no-debug
postgres 985 0.0 1.3 287128 24564 ? Ss 08:40 0:00 /usr/pgsql-13/bin/postmaster -D /var/lib/pgsql/13/data/
apache 1055 0.0 1.2 1828628 23344 ? Sl 08:40 0:00 /usr/sbin/httpd -DFOREGROUND
apache 1054 0.0 1.2 1828628 23152 ? Sl 08:40 0:00 /usr/sbin/httpd -DFOREGROUND
root 949 0.0 1.0 391680 19140 ? Ssl 08:40 0:00 /usr/sbin/NetworkManager --no-daemon
[root@unixcop ~]# For %cpu
[root@unixcop ~]# ps aux --sort -%cpu | head -10
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.1 0.7 186172 14128 ? Ss 08:39 0:02 /usr/lib/systemd/systemd --switched-root --system --deserialize 17
root 1839 0.1 0.0 0 0 ? I 08:53 0:02 [kworker/1:1-events]
root 2 0.0 0.0 0 0 ? S 08:39 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? I< 08:39 0:00 [rcu_gp]
root 4 0.0 0.0 0 0 ? I< 08:39 0:00 [rcu_par_gp]
root 6 0.0 0.0 0 0 ? I< 08:39 0:00 [kworker/0:0H-events_highpri]
root 9 0.0 0.0 0 0 ? I< 08:39 0:00 [mm_percpu_wq]
root 10 0.0 0.0 0 0 ? S 08:39 0:00 [ksoftirqd/0]
root 11 0.0 0.0 0 0 ? I 08:39 0:01 [rcu_sched]
[root@unixcop ~]# Also
Use the below ‘ps’ command format to include a specific information about such processes in the output:
[qadry@rhel-pc ~]$ ps -eo pid,ppid,%mem,%cpu,cmd --sort=-%mem | head
PID PPID %MEM %CPU CMD
4187 1 15.0 7.1 /usr/lib/vmware/bin/vmware-vmx -s vmx.stdio.keep=TRUE -# product=1;name=VMware Workstation;version=16.1.2;buildnumber=17966106;licensename=VMware Workstation;licenseversion=16.0; -@ duplex=3;msgs=ui /run/media/qadry/New Volume/VMs/CentOS 8 64-bit/CentOS 8 64-bit.vmx
3128 2307 7.2 9.0 /usr/lib64/firefox/firefox
3200 3128 7.0 8.0 /usr/lib64/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
1927 1 5.3 0.9 /usr/libexec/packagekitd
5814 3128 4.4 3.3 /usr/lib64/firefox/firefox -contentproc -childID 23 -isForBrowser -prefsLen 10019 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
5438 3128 3.7 1.3 /usr/lib64/firefox/firefox -contentproc -childID 21 -isForBrowser -prefsLen 10019 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
2794 2191 3.2 0.4 /usr/bin/gnome-software --gapplication-service
5047 3128 3.2 1.3 /usr/lib64/firefox/firefox -contentproc -childID 16 -isForBrowser -prefsLen 10019 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
2307 2191 2.7 3.0 /usr/bin/gnome-shell
[qadry@rhel-pc ~]$ If you want to see only the command name instead of the absolute path of the command, use the following ‘ps’ command format:
[qadry@rhel-pc ~]$ ps -eo pid,ppid,%mem,%cpu,comm --sort=-%mem | head
PID PPID %MEM %CPU COMMAND
4187 1 15.0 7.1 vmware-vmx
3128 2307 7.1 9.0 firefox
3200 3128 6.9 7.9 file:// Content
1927 1 5.3 0.9 packagekitd
5814 3128 4.4 3.3 Web Content
5438 3128 3.7 1.3 Web Content
2794 2191 3.2 0.4 gnome-software
5047 3128 3.2 1.3 Web Content
2307 2191 2.7 3.0 gnome-shell
[qadry@rhel-pc ~]$ For me I recommended you to use this command to get top proccess.
[qadry@rhel-pc ~]$ ps -eo pid,ppid,cmd,comm,%mem,%cpu --sort=-%mem | head
PID PPID CMD COMMAND %MEM %CPU
4187 1 /usr/lib/vmware/bin/vmware- vmware-vmx 15.0 7.9
3128 2307 /usr/lib64/firefox/firefox firefox 7.1 9.3
3200 3128 /usr/lib64/firefox/firefox file:// Content 6.3 6.4
1927 1 /usr/libexec/packagekitd packagekitd 5.3 1.0
5814 3128 /usr/lib64/firefox/firefox Web Content 4.1 2.8
5438 3128 /usr/lib64/firefox/firefox Web Content 3.7 1.5
2794 2191 /usr/bin/gnome-software --g gnome-software 3.2 0.4
5047 3128 /usr/lib64/firefox/firefox Web Content 3.2 1.5
4515 2307 /snap/spotify/46/usr/share/ spotify 2.6 3.2
[qadry@rhel-pc ~]$
2-List Top Linux Processes by Memory and CPU Usage using “top”
The Linux ‘top’ command is the best and widely used command that everyone uses to monitor Linux system performance.
It displays a real-time view of the system processes running on the interactive interface.
You should run the top command in batch mode to identify top memory consuming processes in Linux.
[root@unixcop ~]# top -c -b -o +%MEM | head -n 20 | tail -15
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
935 root 20 0 305600 42468 18448 S 0.0 2.3 0:01.00 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
936 root 20 0 229132 40776 39104 S 0.0 2.2 0:00.28 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
964 root 20 0 416596 28384 15104 S 0.0 1.5 0:00.66 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P
1056 apache 20 0 1959764 27272 9976 S 0.0 1.5 0:00.99 /usr/sbin/httpd -DFOREGROUND
867 polkitd 20 0 1631160 25108 17636 S 0.0 1.3 0:00.23 /usr/lib/polkit-1/polkitd --no-debug
985 postgres 20 0 287128 24564 23188 S 0.0 1.3 0:00.14 /usr/pgsql-13/bin/postmaster -D /var/lib/pgsql/13/data/
1055 apache 20 0 1828628 23344 10124 S 0.0 1.2 0:01.04 /usr/sbin/httpd -DFOREGROUND
1054 apache 20 0 1828628 23152 9932 S 0.0 1.2 0:01.04 /usr/sbin/httpd -DFOREGROUND
949 root 20 0 391680 19140 16660 S 0.0 1.0 0:00.20 /usr/sbin/NetworkManager --no-daemon
1053 apache 20 0 664748 17780 9564 S 0.0 1.0 0:00.19 /usr/sbin/httpd -DFOREGROUND
933 root 20 0 227456 15172 12668 S 0.0 0.8 0:00.14 /usr/libexec/sssd/sssd_be --domain implicit_files --uid 0 --gid 0 --logger=fi+
745 root 20 0 128836 14676 9132 S 0.0 0.8 0:00.73 /usr/lib/systemd/systemd-udevd
871 root 20 0 218964 14416 12368 S 0.0 0.8 0:00.08 /usr/sbin/sssd -i --logger=files
[root@unixcop ~]# If you only want to see the command name instead of the absolute path of the command, use the below top command format:
[root@unixcop ~]# top -b -o +%MEM | head -n 20 | tail -15
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
935 root 20 0 305600 42468 18448 S 0.0 2.3 0:01.00 firewalld
936 root 20 0 229132 40776 39104 S 0.0 2.2 0:00.28 sssd_nss
964 root 20 0 416596 28384 15104 S 0.0 1.5 0:00.66 tuned
1056 apache 20 0 1959764 27272 9976 S 6.7 1.5 0:01.01 httpd
867 polkitd 20 0 1631160 25108 17636 S 0.0 1.3 0:00.23 polkitd
985 postgres 20 0 287128 24564 23188 S 0.0 1.3 0:00.14 postmaster
1055 apache 20 0 1828628 23344 10124 S 0.0 1.2 0:01.06 httpd
1054 apache 20 0 1828628 23152 9932 S 0.0 1.2 0:01.06 httpd
949 root 20 0 391680 19140 16660 S 0.0 1.0 0:00.20 NetworkManager
1053 apache 20 0 664748 17780 9564 S 0.0 1.0 0:00.19 httpd
933 root 20 0 227456 15172 12668 S 0.0 0.8 0:00.14 sssd_be
745 root 20 0 128836 14676 9132 S 0.0 0.8 0:00.73 systemd-udevd
871 root 20 0 218964 14416 12368 S 0.0 0.8 0:00.08 sssd
[root@unixcop ~]# 3-Checking high memory consuming Processes in Linux using ‘ps_mem’ command
The ps_mem utility is used to display the core memory used per program (not per process).
This utility allows you to check how much memory used per program.
It calculates the amount of private and shared memory against a program and returns the total used memory in the most appropriate way.
It uses the following logic to calculate RAM usage. Total RAM = sum (private RAM for program processes) + sum (shared RAM for program processes)
[root@unixcop ~]# ps_mem
Private + Shared = RAM used Program
912.0 KiB + 122.0 KiB = 1.0 MiB auditd
696.0 KiB + 340.5 KiB = 1.0 MiB chronyd
952.0 KiB + 157.0 KiB = 1.1 MiB crond
844.0 KiB + 425.0 KiB = 1.2 MiB irqbalance
1.3 MiB + 478.5 KiB = 1.7 MiB dbus-daemon
1.0 MiB + 874.5 KiB = 1.9 MiB login
1.2 MiB + 1.3 MiB = 2.5 MiB bash (2)
1.8 MiB + 1.2 MiB = 3.1 MiB systemd-journald
2.4 MiB + 1.1 MiB = 3.4 MiB systemd-logind
1.8 MiB + 1.7 MiB = 3.5 MiB (sd-pam)
2.8 MiB + 853.0 KiB = 3.7 MiB vmtoolsd
2.2 MiB + 1.8 MiB = 4.0 MiB sssd
3.6 MiB + 839.5 KiB = 4.4 MiB VGAuthService
3.1 MiB + 1.8 MiB = 4.9 MiB sssd_be
1.7 MiB + 3.9 MiB = 5.6 MiB sshd (3)
5.6 MiB + 935.0 KiB = 6.5 MiB rsyslogd
6.5 MiB + 1.1 MiB = 7.6 MiB systemd-udevd
3.5 MiB + 4.6 MiB = 8.1 MiB systemd (2)
6.6 MiB + 1.8 MiB = 8.4 MiB NetworkManager
13.3 MiB + 2.6 MiB = 15.9 MiB tuned
14.9 MiB + 1.6 MiB = 16.5 MiB polkitd
8.9 MiB + 12.8 MiB = 21.7 MiB postmaster (8)
25.6 MiB + 2.9 MiB = 28.5 MiB firewalld
27.6 MiB + 2.0 MiB = 29.6 MiB sssd_nss
44.1 MiB + 9.5 MiB = 53.7 MiB httpd (6)
---------------------------------
239.4 MiB
=================================
[root@unixcop ~]# Conclusion
In this article, we looked at how you list processes on your system and sort them according to RAM and CPU use in descendant form using ps, top and ps_mem utilities.
We saw how to use the ps command to see top resource-consuming processes in Linux. The ps command is a complex command and mastering it comes a long way in properly administering the system and even for using the output in an automation script.
Also we show how to use top command which used to monitor Linux system performance. and we ran it in a batch mode to identify top memory consuming processes in Linux.
Also we used the ps_mem utility is used to display the core memory used per program.
