How to Find Which Processes are Using the Most Memory in Linux

When a Linux server runs out of Random Access Memory (RAM), the operating system begins to aggressively slow down. If the memory exhaustion becomes critical, the Linux kernel’s Out Of Memory (OOM) killer will step in and forcefully terminate applications to keep the server alive. Before this happens, it is crucial to identify which specific processes are consuming the most memory so you can restart them, configure them correctly, or kill them gracefully. Knowing how to locate these memory hogs is a fundamental troubleshooting skill.

Understanding Linux Memory Usage

Linux manages memory differently than Windows. It intentionally uses almost all available RAM for caching files to speed up the system. Therefore, seeing “90% RAM usage” in a monitoring tool is not inherently a problem if most of that is cache. However, if individual applications (like a database, a Java application, or a web server) are consuming vast amounts of active memory, you need to investigate.

Method 1: Using the ‘top’ Command (The Standard Approach)

The top command is installed on almost every Linux distribution by default. It provides a real-time, dynamic view of the processes running on a system.

1. Open your terminal application or connect via SSH.
2. Type top and press Enter.
3. You will see a live dashboard updating every few seconds. By default, top sorts processes by CPU usage, not memory.
4. To sort the list by memory usage, press the Shift + M keys simultaneously on your keyboard.

The list will instantly reorganize. Look at the column labelled %MEM (the percentage of total RAM the process is using) and the column labelled RES (Resident Set Size—the actual physical memory the process is consuming, usually displayed in kilobytes). The application at the very top of the list is your primary memory consumer.

To exit the top interface, press the Q key.

Method 2: Using the ‘ps’ Command (For Scripting and Snapshots)

While top is great for live viewing, sometimes you need a static snapshot of memory usage, or you want to pipe the output into a text file or script. The ps (process status) command is perfect for this.

1. In your terminal, run the following command to list all processes, sort them by memory usage in descending order, and display the top 10 offenders:
   ps aux --sort=-%mem | head -n 11

This command breaks down as follows:

• ps aux lists every running process from all users.
• --sort=-%mem sorts the output by the percentage of memory used, with the highest values at the top (the minus sign indicates descending order).
• | head -n 11 pipes the massive output into the head command, telling it to only display the first 11 lines (1 header line + the top 10 processes).

Method 3: Using ‘htop’ (The Visual Upgrade)

If you find the output of top or ps difficult to read, htop provides a much friendlier, colour-coded interface with clear visual meters for CPU and RAM usage.

1. You may need to install it first. (On Ubuntu/Debian, run sudo apt install htop. On CentOS/RHEL, run sudo yum install htop).
2. Type htop and press Enter.
3. To sort by memory, press the F6 key.
4. Use your arrow keys to select PERCENT_MEM from the left-hand menu and press Enter.

The processes consuming the most memory will now appear at the top of the list. You can even highlight a problematic process with your arrow keys and press F9 to kill it directly from the interface.

Troubleshooting Common Misinterpretations

When analyzing memory usage, be careful not to misread the data:

• VIRT vs RES in top: The VIRT (Virtual Memory) column in top often displays massive numbers, sometimes larger than your total physical RAM. Do not panic. VIRT includes everything the program might need, including shared libraries and swapped memory. Focus on the RES (Resident) column, which shows the actual, physical RAM currently locked by the application.

By utilizing these commands, you can rapidly diagnose memory leaks and ensure your Linux server remains stable under heavy loads.