$ Linux One Liners
Back to lessons

Hosting Operations

Find the Processes Eating Memory

You need to see which processes are using the most RAM.

Command

ps -eo pid,ppid,stat,pcpu,pmem,rss,comm,args --sort=-pmem | head -n 10

What changed

Nothing changes. The command reads process metadata and sorts by memory percentage.

Danger

safe

When to use it

Use when memory is low, swapping is suspected, or an app may be leaking memory.

When not to use it

Do not use it to estimate total memory health by itself; check free -h too.

Undo or recovery

No undo needed because this command is read-only.

Expected output

A process list sorted by memory percentage, with RSS shown for each process.

demo script

Disposable terminal steps

  1. free -h
  2. ps -eo pid,ppid,stat,pcpu,pmem,rss,comm,args --sort=-pmem | head -n 10
Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel 
::fixture-ready::
$ free -h
               total        used        free      shared  buff/cache   available
Mem:           1.9Gi       1.4Gi        94Mi        18Mi       410Mi       312Mi
Swap:          2.0Gi       620Mi       1.4Gi
::exit-code::0
$ ps -eo pid,ppid,stat,pcpu,pmem,rss,comm,args --sort=-pmem | head -n 10
  PID  PPID STAT %CPU %MEM   RSS COMMAND        COMMAND
 2011     1 S     4.5  37.9 776M postgres      postgres: main
 1842     1 R    86.4  14.2 291M app-worker    /srv/app/worker --jobs
 1907     1 S    12.8   3.1  63M nginx         nginx: worker process
::exit-code::0

YouTube Short

Find memory-heavy processes.

Low memory needs evidence. Sort ps by memory and include RSS so the largest resident processes stand out.

LinkedIn hook

Memory pressure can look like a slow app, a stuck deploy, or random crashes.

Question: When memory is tight, do you inspect total memory first or top processes first?

experiments

A/B tests to run

Metric: completion_rate

A: Lead with memory pressure.

B: Lead with leaking process suspicion.