How to Find Which Process Is Using Your RAM

When a Linux server runs low on memory, performance slows down dramatically as the system swaps memory to disk or triggers the dreaded Linux Out-Of-Memory (OOM) Killer to abruptly terminate vital services.

In this guide, you will learn how to accurately determine which processes are consuming your RAM on a RivinCloud VPS.

1. Fast Overview of Top RAM Consumers

Method A: Sorting Processes by Memory with ps

Run the following command to see the top 10 memory-hungry processes:

ps aux --sort=-%mem | head -n 11

Key columns to look at:

• %MEM: Percentage of total physical memory used.
• RSS (Resident Set Size): The actual amount of physical RAM (in kilobytes) allocated to that process in non-swapped memory.
• VSZ (Virtual Size): Total virtual memory footprint allocated (including shared libraries and mapped files).

Method B: Using top Sorted by Memory

1. Type top in your terminal.
2. Press Shift + M to sort all active tasks by memory consumption.
3. Press q to quit.

Method C: Visual Process Breakdown with htop

Run htop and press F6, then choose PERCENT_MEM to sort.

2. Calculating Exact Memory Usage Per Program

Often multiple worker threads of the same program (like PHP-FPM, Apache, or MySQL) run under different PIDs. To calculate the combined RAM usage of a specific service:

Example: Checking Total RAM Used by Nginx / PHP-FPM

ps --no-headers -o "rss,cmd" -C php-fpm8.2 | awk '{ sum+=$1 } END { printf ("%.2f MB\n", sum/1024) }'

Inspecting Detailed Process Memory: pmap

To inspect the internal memory map of a specific PID:

pmap -x <PID> | tail -n 1

3. Dealing with the OOM (Out Of Memory) Killer

When available RAM drops to zero, the Linux kernel invokes the OOM Killer, which reviews process "badness" scores and kills the heaviest offenders.

How to Check if the OOM Killer Triggered

Search your system kernel log for OOM events:

sudo dmesg -T | grep -i -E "oom|killed process"

Or check journalctl:

sudo journalctl -k --grep="Out of memory"

Common Mistakes

• Looking only at VSZ instead of RSS: Virtual memory includes shared libraries that are not physically taking up unique RAM blocks.
• Confusing Buffer/Cache with Leaked RAM: Remember that Linux intentionally caches file reads into RAM until other processes request it.
• Not setting memory limits for database and Java applications: Services like MySQL or Minecraft will consume all available memory unless bounded in configuration files (my.cnf or Java -Xmx flags).

Troubleshooting

• Server swapping excessively: Check swap activity with vmstat 1 5. High si (swap in) and so (swap out) numbers mean your VPS is thrashing disk I/O due to RAM starvation.
• Memory not freeing after process kill: If memory remains allocated, verify shared memory blocks with ipcs -m.

Best Practices

[!TIP] Always configure a swap file on your VPS to provide a buffer for sudden RAM spikes:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

• Define memory limits in systemd service units using MemoryMax=1G.
• Set up monitoring alerts to trigger when memory utilization consistently crosses 85%.

Frequently Asked Questions

What is the difference between RSS and VSZ?

RSS is the exact amount of physical RAM currently occupied by the process. VSZ is the total virtual address space requested, much of which may not even be in physical memory.

Why does free memory look so low on Linux?

Linux uses unused RAM for disk caching to accelerate read performance. This memory is marked as available and is freed instantly whenever an application requires it.

Conclusion

Knowing how to pinpoint RAM-heavy processes enables you to optimize configurations, scale hardware appropriately on RivinCloud, and ensure uninterrupted uptime for your critical services.