How to View Process Memory Usage in Linux using the pmap Command

Beyond the Top Command

When a Linux server begins to run out of RAM, system administrators reflexively launch the top or htop commands. These tools provide an excellent high-level overview, showing that the java process or the mysqld daemon is consuming 80% of the system memory.

However, top cannot tell you why that specific process is consuming so much memory. Is the application loading massive shared libraries? Is it hoarding anonymous heap memory due to a memory leak? To perform a deep forensic analysis of a single application’s memory footprint, you must use the pmap (Process Memory Map) command.

Finding the Process ID (PID)

The pmap utility cannot monitor the entire system at once; it requires you to target a specific running process using its PID.

If you know the name of the application (e.g., nginx), you can quickly find its PID using the pidof command:

pidof nginx

Assume this returns the PID 4125.

Using the pmap Command

To view the memory map of the Nginx worker process, run pmap followed by the PID. Because memory mapping involves deep kernel space, it is highly recommended to run this command with sudo to ensure you can read all segments.

sudo pmap 4125

The output will be a massive, scrolling list of hexadecimal memory addresses.

4125:   nginx: worker process
000055a4b1234000     12K r-x-- nginx
000055a4b1434000      4K r---- nginx
000055a4b1435000      4K rw--- nginx
000055a4b2789000   1024K rw---   [ anon ]
00007f8b9a123000   2048K r-x-- libc-2.31.so
...
total           10564K

Understanding the Output

• Column 1 (Hex Address): The exact virtual memory address space allocated to the process.
• Column 2 (Size): The amount of RAM consumed by that specific allocation block (e.g., 1024K).
• Column 3 (Permissions): Indicates if the memory is Read (r), Write (w), or Execute (x).
• Column 4 (Mapping): This is the most critical column. It shows exactly what is sitting in that memory space. It might be the main executable file, a shared library (like libc), or [ anon ].

Identifying Memory Leaks

The [ anon ] (Anonymous) mapping is the most important metric for developers and system administrators. Anonymous memory is dynamically allocated RAM (the heap or the stack) that is not tied to a specific file on the hard drive.

If you run pmap on a Java or Python application and see an [ anon ] block that is consuming gigabytes of RAM (and growing larger every time you run the command), you have successfully identified a classic memory leak in the application code.

Extended Format for Deep Dives

If the standard output is not detailed enough, you can append the -x (extended) flag.

sudo pmap -x 4125

This adds columns for RSS (Resident Set Size – the exact amount of physical RAM actually in use) and Dirty memory (memory that has been modified and cannot be simply swapped out to disk without being written first). High amounts of Dirty memory combined with a massive [ anon ] block definitively confirm an application is hoarding RAM uncontrollably.