Skip to main content
ToolsRunbooksBlogDocs

rawops.dev

P2

High Memory Usage — Linux Troubleshooting Guide

Diagnose high memory usage on Linux. Covers understanding free vs available memory, finding memory-hungry processes, detecting leaks, managing swap, and cache behavior.

15 min8 steps
linuxmemoryramoomswapperformance
Progress: 0/8 steps
0%

Get a clear picture of total, used, free, and available memory.

free -h && echo '---' && cat /proc/meminfo | head -10
Expected: Key metric is 'available' (not 'free'). Linux uses free RAM for cache/buffers — this is normal. Available = free + reclaimable cache. Worry only if 'available' is low.
Low 'free' memory does NOT mean you have a problem. Linux intentionally uses free RAM for disk cache. Check 'available' instead.

Identify which processes are using the most RAM.

ps aux --sort=-%mem | head -15 && echo '---' && ps aux --sort=-rss | awk 'NR<=10{printf "%-8s %-8s %6s MB  %s\n", $1, $2, $6/1024, $11}'
Expected: Shows processes sorted by memory usage. RSS (Resident Set Size) is the actual physical memory used.

A process with steadily growing memory over time likely has a leak.

# Check RSS over time for a specific PID:
while true; do ps -p PID -o rss=,vsz=,comm= && sleep 5; done

# Or use smem for accurate per-process breakdown:
smem -rkt -s pss | head -15 2>/dev/null || echo 'smem not installed (apt install smem)'
Expected: If RSS keeps growing without stabilizing, the process has a memory leak. PSS (Proportional Set Size) from smem is more accurate for shared memory.

High swap usage means physical RAM was exhausted. Swapping causes severe performance degradation.

swapon -s && echo '---' && free -h | grep Swap && echo '---' && vmstat 1 3 | tail -3
Expected: Swap used should ideally be 0. In vmstat, 'si/so' (swap in/out) > 0 means active swapping is happening.

Identify which processes have been swapped out.

for f in /proc/[0-9]*/status; do awk '/VmSwap/{swap=$2} /Name/{name=$2} END{if(swap>0) printf "%8d KB %s\n",swap,name}' $f; done 2>/dev/null | sort -rn | head -15
Expected: Shows processes with data in swap, sorted by swap usage. These processes are experiencing slowdowns from disk I/O.

Kernel slab allocators (dentry cache, inode cache) can consume significant memory.

slabtop -o -s c 2>/dev/null | head -15 || cat /proc/meminfo | grep -E 'Slab|SReclaimable|SUnreclaim'
Expected: SReclaimable is memory the kernel can free under pressure. SUnreclaim is memory the kernel needs. Large slab usually means many files/inodes in cache.

Force the kernel to drop file caches. Only for emergencies — the system will rebuild caches and may slow down temporarily.

# Check reclaimable cache:
free -h | awk '/Mem/{print "Reclaimable cache: " $6}'

# Drop page cache, dentries, and inodes:
sync && echo 3 > /proc/sys/vm/drop_caches && free -h
Expected: 'Free' memory increases after dropping caches. This is a temporary fix — investigate the root cause.
Dropping caches causes temporary I/O performance degradation as the system re-reads frequently accessed files from disk. Only use in emergencies.

Apply the appropriate fix based on your diagnosis.

# Kill a runaway process:
kill -15 PID  # graceful
kill -9 PID   # forced

# Restart a leaking service:
systemctl restart SERVICE_NAME

# Set memory limits for a service:
systemctl edit SERVICE_NAME
# Add: [Service]\nMemoryMax=2G\nMemoryHigh=1.5G
Expected: Memory should stabilize after killing the offending process or restarting the service. Use systemd MemoryMax to prevent recurrence.