How to Use ps to List Top Memory, CPU Eating Processes

The ps command is a versatile and configurable way to look at the processes running on your system, though I’ve generally gotten by with a lazy ps -ef to find out whatever I needed to know. Recently, though, a client’s server began running out of memory, and as a number of processes were running on the server, the culprit was not immediately clear. I wanted to provide them with a quick, simple diagnostic tool they could use the next time they received an alert.

If you look at the man page for ps you’ll find a number of options available for sorting the list of processes returned as well as for filtering the columns displayed.

Some examples of ps options, from RHEL 5.6:

-e
select all processes

-a
select all “child” processes

-U <user>
select all processes for a specified user

-p <pid>
select by process id

-f
full-format listing; adds columns and shows process arguments

-o
user-defined format

Many others are available, of course, but in order to keep it simple for the client I wanted to show the top 10 processes in terms of memory utilization, with the pid, memory usage, and process name displayed. Here is what I came up with:

$ ps -eo pid,user,pmem,args O R | tail -n 10

And here is an explanation:

ps
shows running processes

      -e
show all processes

      -o pid,user,poem,args
show the pid, %mem, and process columns

      O R
sort by memory usage (ascending)

tail
shows only the last lines

      -n 10
show the last 10 lines

I liked the concept so much that I decided to adapt it for OS X, where the ps command takes a slightly different set of arguments. To my .bash_profile file I added the following lines:

alias psmem="while :; do clear; ps -ecm -o %mem,rss,pid,user,state,args | head -n 10; sleep 5; done"
alias pscpu="while :; do clear; ps -ecr -o %cpu,pid,user,state,args | head -n 10; sleep 2; done"

I have one alias for retrieving my top memory-utilizing processes and one for my top CPU-utilizing processes. The while loop in the alias implements a functionality similar to that of the Linux watch command, clearing the screen and running the process indefinitely until it is forcibly quit. For my own purposes I wanted to display some additional columns, like username and process state. I also changed the sort ordering to display the largest processes at the top of the list.