How to find out what process are eating all memory

8

2

Im using SUSE, i have 31GB of memory Mem: 31908592k total, 31429632k used, 478960k free, 12176k buffers How do I find out what process are eating up all my memory.

AlBouazizi

Posted 2011-07-08T08:14:22.257

Reputation: 539

The used memory was 22GB i ran rsync command then it starts eating my memory.. i kill -9 rsync.. the used memory was increased but never reduced after killing the rsync process – AlBouazizi – 2011-07-08T08:17:34.843

1... Why did you kill -9 rsync?! rsync has proper mechanisms for shutting down, and kill -9 is never one of them. – Ignacio Vazquez-Abrams – 2011-07-08T08:19:07.430

Why i kill -9 rsync? boz i noticed it is taking lots of memry i will be running out of mem.. is there other way to stop rsync? thank you for your reply – AlBouazizi – 2011-07-08T08:25:13.713

1Uh, yes. Ctrl-C. – Ignacio Vazquez-Abrams – 2011-07-08T08:26:04.913

Or even just plain kill without the -9, or kill -2 if you want the exact same effect as ctrl-C, but you don't have an open terminal connected to the process. – Dave Sherohman – 2011-07-08T10:08:25.980

Answers

9

Looks like you're running free, looking at the first line, and freaking out. That's OK; a lot of people do that.

Ignore the first line of output from free. Really. Linux is very aggressive about caching data from disk, even including "swapped out" virtual memory pages, in RAM and all that cached data is counted as "used" in free's first line, even though it can be made available again in a microsecond (or less, these days) if needed.

You need to be looking at the second line of output from free, the one labeled -/+ buffers/cache:. That's the line which will tell you how much memory is actually tied up by running programs, ignoring what's being used for the moment by buffers and cache.

For example, my machine currently shows:

             total       used       free     shared    buffers     cached
Mem:       3083924    2177300     906624          0     461344     837008
-/+ buffers/cache:     878948    2204976
Swap:      4000148          0    4000148

Although there are only 906624 bytes of RAM sitting completely unused at the moment, there are an additional 461344 bytes of buffers and 837008 bytes of cached data which can be made available more-or-less instantly if something more important (i.e., just about anything) needs the memory, giving me a total of 2204976 bytes actually available to me.

Dave Sherohman

Posted 2011-07-08T08:14:22.257

Reputation: 5 143

thank you for your reply my question is why i have 30GB used with running anythting? total used free shared buffers cached Mem: 31908592 31407424 501168 0 12176 0 -/+ buffers/cache: 31395248 513344 Swap: 10239968 112 10239856

Im still looking for mem size of 30906256 which program is using this mem, nothing is running at the moment .. that is my question – AlBouazizi – 2011-07-08T13:16:32.950

8

Run top, then press ShiftO, then N, then finally Enter. Press Q when you want to exit.

And don't forget, "Linux ate my RAM!".

Ignacio Vazquez-Abrams

Posted 2011-07-08T08:14:22.257

Reputation: 100 516

@Abrams: thank you, i have ran top with shift o then N it show many smbd owned by root which was not seen it top only? can you explain please? – AlBouazizi – 2011-07-08T08:33:59.587

+1 for link explaining Linux's aggressive caching policy. – Dave Sherohman – 2011-07-08T09:56:57.020

1

Use the top command. It shows a list of all processes running, sorted by those which are using the most CPU by default. If you hit shiftM it will change to sort by memory usage instead. You'll see the top memory offenders at the top of the list.

Flimzy

Posted 2011-07-08T08:14:22.257

Reputation: 4 168

thank you for you reply.. i even capture the top windows with shift M.. i don't see the process with is taliking a big mem.. i want to show you the captured img .. how is possible to attach the img to my reply to you.. im still new in superuser.. thank you – AlBouazizi – 2011-07-08T08:47:59.090

Don't attach an image, just copy and paste the test--it's much easier to read that way. – Flimzy – 2011-07-08T08:50:03.317

@AlBouazizi: Apparently you forgot to read the bit in my answer that I told you not to forget... – Ignacio Vazquez-Abrams – 2011-07-08T08:56:11.050