Qadry
unixcop Admin

How to Find Top Running Processes by Memory and CPU Usage

Introduction

Linux is quite popular for its command-line utilities, which not only make any task at hand easier but also saves a lot of time, which is otherwise wasted in graphical UI based utilities.

This is one of the reasons why Linux is a preferred operating system for servers and administrative machines. Combine the knowledge of Linux commands and shell scripting and you have a proper toolkit of system administration at your disposal.

You may have noticed that sometimes your system consumes too much of memory, which makes your application’s slow or unresponsive.

What do you think would be the best approach to identify the processes that are consuming more memory in a Linux machine?

So This can_be easily identified using the top command and the ps command and we will explain how to use these two commands to identify which processes are eating all the resources on your system.

Today we will see how to see the top heaviest memory and CPU resource-consuming processes in Linux.

List All Running Processes in Linux

We will explain three methods to achieve that

1-List Top Linux Processes by Memory and CPU Usage using “ps”

So The ps command has a lot of options and arguments available to display output in different formats. However, it can be simply run with the argument ‘aux’ to get a general overview of running processes.

# ps aux

We will use the argument ‘–sort’ to sort the output by memory and CPU usage.

The syntax for using the sort argument is:

# ps aux --sort <column_name>

Similarly, to reverse sort the output, the following canbe used:

# ps aux --sort -<column_name>

Since we want the top processes by memory and CPU usage, we will sort the output by reverse, and put these columns as the column name argument.

Find Top Running Processes by Memory Usage

$ ps aux --sort -%mem

Find Top Running Processes by CPU Usage

$ ps aux --sort -%cpu

Finally, to limit the number of processes shown to 10, we pipe the output to the head command.

For %mem

[root@unixcop ~]# ps aux --sort -%mem | head -10
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         935  0.0  2.2 305600 42468 ?        Ssl  08:40   0:01 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
root         936  0.0  2.1 229132 40776 ?        S    08:40   0:00 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
root         964  0.0  1.5 416596 28384 ?        Ssl  08:40   0:00 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P
apache      1056  0.0  1.4 1959764 27272 ?       Sl   08:40   0:00 /usr/sbin/httpd -DFOREGROUND
polkitd      867  0.0  1.3 1631160 25108 ?       Ssl  08:40   0:00 /usr/lib/polkit-1/polkitd --no-debug
postgres     985  0.0  1.3 287128 24564 ?        Ss   08:40   0:00 /usr/pgsql-13/bin/postmaster -D /var/lib/pgsql/13/data/
apache      1055  0.0  1.2 1828628 23344 ?       Sl   08:40   0:00 /usr/sbin/httpd -DFOREGROUND
apache      1054  0.0  1.2 1828628 23152 ?       Sl   08:40   0:00 /usr/sbin/httpd -DFOREGROUND
root         949  0.0  1.0 391680 19140 ?        Ssl  08:40   0:00 /usr/sbin/NetworkManager --no-daemon
[root@unixcop ~]# 

For %cpu

[root@unixcop ~]# ps aux --sort -%cpu | head -10
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.1  0.7 186172 14128 ?        Ss   08:39   0:02 /usr/lib/systemd/systemd --switched-root --system --deserialize 17
root        1839  0.1  0.0      0     0 ?        I    08:53   0:02 [kworker/1:1-events]
root           2  0.0  0.0      0     0 ?        S    08:39   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   08:39   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   08:39   0:00 [rcu_par_gp]
root           6  0.0  0.0      0     0 ?        I<   08:39   0:00 [kworker/0:0H-events_highpri]
root           9  0.0  0.0      0     0 ?        I<   08:39   0:00 [mm_percpu_wq]
root          10  0.0  0.0      0     0 ?        S    08:39   0:00 [ksoftirqd/0]
root          11  0.0  0.0      0     0 ?        I    08:39   0:01 [rcu_sched]
[root@unixcop ~]# 

Also

Use the below ‘ps’ command format to include a specific information about such processes in the output:

[qadry@rhel-pc ~]$ ps -eo pid,ppid,%mem,%cpu,cmd --sort=-%mem | head
    PID    PPID %MEM %CPU CMD
   4187       1 15.0  7.1 /usr/lib/vmware/bin/vmware-vmx -s vmx.stdio.keep=TRUE -# product=1;name=VMware Workstation;version=16.1.2;buildnumber=17966106;licensename=VMware Workstation;licenseversion=16.0; -@ duplex=3;msgs=ui /run/media/qadry/New Volume/VMs/CentOS 8 64-bit/CentOS 8 64-bit.vmx
   3128    2307  7.2  9.0 /usr/lib64/firefox/firefox
   3200    3128  7.0  8.0 /usr/lib64/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
   1927       1  5.3  0.9 /usr/libexec/packagekitd
   5814    3128  4.4  3.3 /usr/lib64/firefox/firefox -contentproc -childID 23 -isForBrowser -prefsLen 10019 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
   5438    3128  3.7  1.3 /usr/lib64/firefox/firefox -contentproc -childID 21 -isForBrowser -prefsLen 10019 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
   2794    2191  3.2  0.4 /usr/bin/gnome-software --gapplication-service
   5047    3128  3.2  1.3 /usr/lib64/firefox/firefox -contentproc -childID 16 -isForBrowser -prefsLen 10019 -prefMapSize 220513 -parentBuildID 20210716063838 -appdir /usr/lib64/firefox/browser 3128 tab
   2307    2191  2.7  3.0 /usr/bin/gnome-shell
[qadry@rhel-pc ~]$ 

If you want to see only the command name instead of the absolute path of the command, use the following ‘ps’ command format:

[qadry@rhel-pc ~]$ ps -eo pid,ppid,%mem,%cpu,comm --sort=-%mem | head
    PID    PPID %MEM %CPU COMMAND
   4187       1 15.0  7.1 vmware-vmx
   3128    2307  7.1  9.0 firefox
   3200    3128  6.9  7.9 file:// Content
   1927       1  5.3  0.9 packagekitd
   5814    3128  4.4  3.3 Web Content
   5438    3128  3.7  1.3 Web Content
   2794    2191  3.2  0.4 gnome-software
   5047    3128  3.2  1.3 Web Content
   2307    2191  2.7  3.0 gnome-shell
[qadry@rhel-pc ~]$ 

For me I recommended you to use this command to get top proccess.

[qadry@rhel-pc ~]$ ps -eo pid,ppid,cmd,comm,%mem,%cpu --sort=-%mem | head
    PID    PPID CMD                         COMMAND         %MEM %CPU
   4187       1 /usr/lib/vmware/bin/vmware- vmware-vmx      15.0  7.9
   3128    2307 /usr/lib64/firefox/firefox  firefox          7.1  9.3
   3200    3128 /usr/lib64/firefox/firefox  file:// Content  6.3  6.4
   1927       1 /usr/libexec/packagekitd    packagekitd      5.3  1.0
   5814    3128 /usr/lib64/firefox/firefox  Web Content      4.1  2.8
   5438    3128 /usr/lib64/firefox/firefox  Web Content      3.7  1.5
   2794    2191 /usr/bin/gnome-software --g gnome-software   3.2  0.4
   5047    3128 /usr/lib64/firefox/firefox  Web Content      3.2  1.5
   4515    2307 /snap/spotify/46/usr/share/ spotify          2.6  3.2
[qadry@rhel-pc ~]$ 

2-List Top Linux Processes by Memory and CPU Usage using “top”

The Linux ‘top’ command is the best and widely used command that everyone uses to monitor Linux system performance.

It displays a real-time view of the system processes running on the interactive interface.

You should run the top command in batch mode to identify top memory consuming processes in Linux.

[root@unixcop ~]# top -c -b -o +%MEM | head -n 20 | tail -15

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
    935 root      20   0  305600  42468  18448 S   0.0   2.3   0:01.00 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
    936 root      20   0  229132  40776  39104 S   0.0   2.2   0:00.28 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
    964 root      20   0  416596  28384  15104 S   0.0   1.5   0:00.66 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P
   1056 apache    20   0 1959764  27272   9976 S   0.0   1.5   0:00.99 /usr/sbin/httpd -DFOREGROUND
    867 polkitd   20   0 1631160  25108  17636 S   0.0   1.3   0:00.23 /usr/lib/polkit-1/polkitd --no-debug
    985 postgres  20   0  287128  24564  23188 S   0.0   1.3   0:00.14 /usr/pgsql-13/bin/postmaster -D /var/lib/pgsql/13/data/
   1055 apache    20   0 1828628  23344  10124 S   0.0   1.2   0:01.04 /usr/sbin/httpd -DFOREGROUND
   1054 apache    20   0 1828628  23152   9932 S   0.0   1.2   0:01.04 /usr/sbin/httpd -DFOREGROUND
    949 root      20   0  391680  19140  16660 S   0.0   1.0   0:00.20 /usr/sbin/NetworkManager --no-daemon
   1053 apache    20   0  664748  17780   9564 S   0.0   1.0   0:00.19 /usr/sbin/httpd -DFOREGROUND
    933 root      20   0  227456  15172  12668 S   0.0   0.8   0:00.14 /usr/libexec/sssd/sssd_be --domain implicit_files --uid 0 --gid 0 --logger=fi+
    745 root      20   0  128836  14676   9132 S   0.0   0.8   0:00.73 /usr/lib/systemd/systemd-udevd
    871 root      20   0  218964  14416  12368 S   0.0   0.8   0:00.08 /usr/sbin/sssd -i --logger=files
[root@unixcop ~]# 

If you only want to see the command name instead of the absolute path of the command, use the below top command format:

[root@unixcop ~]# top -b -o +%MEM | head -n 20 | tail -15

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
    935 root      20   0  305600  42468  18448 S   0.0   2.3   0:01.00 firewalld
    936 root      20   0  229132  40776  39104 S   0.0   2.2   0:00.28 sssd_nss
    964 root      20   0  416596  28384  15104 S   0.0   1.5   0:00.66 tuned
   1056 apache    20   0 1959764  27272   9976 S   6.7   1.5   0:01.01 httpd
    867 polkitd   20   0 1631160  25108  17636 S   0.0   1.3   0:00.23 polkitd
    985 postgres  20   0  287128  24564  23188 S   0.0   1.3   0:00.14 postmaster
   1055 apache    20   0 1828628  23344  10124 S   0.0   1.2   0:01.06 httpd
   1054 apache    20   0 1828628  23152   9932 S   0.0   1.2   0:01.06 httpd
    949 root      20   0  391680  19140  16660 S   0.0   1.0   0:00.20 NetworkManager
   1053 apache    20   0  664748  17780   9564 S   0.0   1.0   0:00.19 httpd
    933 root      20   0  227456  15172  12668 S   0.0   0.8   0:00.14 sssd_be
    745 root      20   0  128836  14676   9132 S   0.0   0.8   0:00.73 systemd-udevd
    871 root      20   0  218964  14416  12368 S   0.0   0.8   0:00.08 sssd
[root@unixcop ~]# 

3-Checking high memory consuming Processes in Linux using ‘ps_mem’ command

The ps_mem utility is used to display the core memory used per program (not per process).

This utility allows you to check how much memory used per program.

It calculates the amount of private and shared memory against a program and returns the total used memory in the most appropriate way.

It uses the following logic to calculate RAM usage. Total RAM = sum (private RAM for program processes) + sum (shared RAM for program processes)

[root@unixcop ~]# ps_mem
 Private  +   Shared  =  RAM used	Program

912.0 KiB + 122.0 KiB =   1.0 MiB	auditd
696.0 KiB + 340.5 KiB =   1.0 MiB	chronyd
952.0 KiB + 157.0 KiB =   1.1 MiB	crond
844.0 KiB + 425.0 KiB =   1.2 MiB	irqbalance
  1.3 MiB + 478.5 KiB =   1.7 MiB	dbus-daemon
  1.0 MiB + 874.5 KiB =   1.9 MiB	login
  1.2 MiB +   1.3 MiB =   2.5 MiB	bash (2)
  1.8 MiB +   1.2 MiB =   3.1 MiB	systemd-journald
  2.4 MiB +   1.1 MiB =   3.4 MiB	systemd-logind
  1.8 MiB +   1.7 MiB =   3.5 MiB	(sd-pam)
  2.8 MiB + 853.0 KiB =   3.7 MiB	vmtoolsd
  2.2 MiB +   1.8 MiB =   4.0 MiB	sssd
  3.6 MiB + 839.5 KiB =   4.4 MiB	VGAuthService
  3.1 MiB +   1.8 MiB =   4.9 MiB	sssd_be
  1.7 MiB +   3.9 MiB =   5.6 MiB	sshd (3)
  5.6 MiB + 935.0 KiB =   6.5 MiB	rsyslogd
  6.5 MiB +   1.1 MiB =   7.6 MiB	systemd-udevd
  3.5 MiB +   4.6 MiB =   8.1 MiB	systemd (2)
  6.6 MiB +   1.8 MiB =   8.4 MiB	NetworkManager
 13.3 MiB +   2.6 MiB =  15.9 MiB	tuned
 14.9 MiB +   1.6 MiB =  16.5 MiB	polkitd
  8.9 MiB +  12.8 MiB =  21.7 MiB	postmaster (8)
 25.6 MiB +   2.9 MiB =  28.5 MiB	firewalld
 27.6 MiB +   2.0 MiB =  29.6 MiB	sssd_nss
 44.1 MiB +   9.5 MiB =  53.7 MiB	httpd (6)
---------------------------------
                        239.4 MiB
=================================
[root@unixcop ~]# 

Conclusion

In this article, we looked at how you list processes on your system and sort them according to RAM and CPU use in descendant form using ps, top and ps_mem utilities.

We saw how to use the ps command to see top resource-consuming processes in Linux. The ps command is a complex command and mastering it comes a long way in properly administering the system and even for using the output in an automation script.

Also we show how to use top command which used to monitor Linux system performance. and we ran it in a batch mode to identify top memory consuming processes in Linux.

Also we used the ps_mem utility is used to display the core memory used per program.

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest articles

x