Hi, 

I've a memory problem on my server, I would like to know what command
could help me to localise what process is using all the memory.

I've tried:
root@server1 [/]# free -m
total used free shared buffers cached
Mem: 8029 8016 12 0 195 3386
-/+ buffers/cache: 4434 3594
Swap: 8000 3318 4682


So I know their is something not normal...
I use the TOP and I look at the VIRT column but I'm not sure if it's
the good way to solve my problem as I don't get to 8gb of memory used
this way.

---

Request for Question Clarification by maniac-ga on 02 Jun 2006 19:01 PDT

Hello Fmaz,

Please indicate the type of operating system you are using - I assume
Unix (or Linux) based on what you've said so far, but I cannot be
certain.

Also indicate what kind of memory you are concerned about. I cannot
tell if you mean virtual memory (e.g., physical + swap / paging areas)
or physical memory (or something else).

Note that Linux in particular runs in a "memory full" mode of
operation where the OS tends to use all of the physical memory for
current activities (including file and directory caching) - that is
normal for that OS.

  --Maniac

---

Request for Question Clarification by maniac-ga on 02 Jun 2006 19:02 PDT

Hello Fmaz,

Argh. Ignore the first part of the previous request - I see from the
subject you are concerned about Linux. I do need to know about the
type of memory you are concerned about / how it is impacting
performance of the server.

  --Maniac

have you tried memtest86? it's a boot cd used for diagnosing memory issues.
let me know if this helped

Leech, I see the problem as a usage problem, though it of course might
not hurt to check memory.

If top does not give you the answer, then I suggest posting this
question on a specialty URL, such as www.justlinux.com  Registration
required, it is free, and if they can't help you there is no help
available. Do read posting rules, and make title relevant to issue.

You may also wish to see:

http://gentoo-wiki.com/FAQ_Linux_Memory_Management

This article describes a need to recompile the linx kernel for more
than ~800MB RAM, and explains why.

For those who don't know what CENT-OS is, there is a well known linux
and somewhat pricey distro which specializes in corporate
installations and support for their product. Under licensing rules,
they must return to the public their linux-derivative works.  However,
they are NOT required to allow the use of their somewhat prestigious
name on their open releases. So, their basic distro, minus the
proprietary applications is taken by one of several communities, and
the company name and logos are replaced. In this case, replaced with
Cent-Os, and I think there are several others.  And, of course, the
Cent-Os users do not have access to the excellent support system of
that well-known company.

the command "ps axu" will give you all the information you need:

Sample:

[tusker:~]$ps axu 
USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  1392  444 ?        S    Jun21   0:04 init [5]       
root         2  0.0  0.0     0    0 ?        SW   Jun21   0:00 [keventd]
root         3  0.0  0.0     0    0 ?        SWN  Jun21   0:00 [ksoftirqd_CPU0]
root         4  0.0  0.0     0    0 ?        SW   Jun21   0:01 [kswapd]
root         5  0.0  0.0     0    0 ?        SW   Jun21   0:00 [bdflush]
root         6  0.0  0.0     0    0 ?        SW   Jun21   0:00 [kupdated]
root         7  0.0  0.0     0    0 ?        SW<  Jun21   0:00 [mdrecoveryd]
root        58  0.0  0.0     0    0 ?        SW   Jun21   0:00 [khubd]
root       162  0.0  0.0     0    0 ?        SW   Jun21   0:00 [kjournald]
root       163  0.0  0.0     0    0 ?        SW   Jun21   0:00 [kjournald]
root       437  0.0  0.1  1696  760 ?        S    Jun21   0:00 syslogd -m 0
root       441  0.0  0.0  1388  428 ?        S    Jun21   0:00 klogd -x
rpc        453  0.0  0.1  1560  552 ?        S    Jun21   0:00 portmap
rpcuser    472  0.0  0.2  4368 1480 ?        S    Jun21   0:00 rpc.statd
ntp        527  0.0  0.4  2412 2404 ?        SL   Jun21   0:00 ntpd -U ntp -g
nobody     536  0.0  2.7 64936 14356 ?       S    Jun21   0:00 dictd 1.9.7: 1/1 
root       627  0.0  0.1  1504  596 ?        S    Jun21   0:00 /usr/sbin/automou
root       629  0.0  0.1  1504  596 ?        S    Jun21   0:00 /usr/sbin/automou
root       636  0.0  0.1  1504  596 ?        S    Jun21   0:00 /usr/sbin/automou
root       663  0.0  0.1  1504  596 ?        S    Jun21   0:00 /usr/sbin/automou
root       686  0.0  0.1  1504  596 ?        S    Jun21   0:00 /usr/sbin/automou
root       688  0.0  0.1  1504  596 ?        S    Jun21   0:00 /usr/sbin/automou
root       716  0.0  0.2  3524 1352 ?        S    Jun21   0:00 /usr/sbin/sshd
root       730  0.0  0.1  2080  868 ?        S    Jun21   0:00 xinetd -stayalive
root       750  0.0  0.2  4356 1440 ?        S    Jun21   0:00 crond
root       792  0.0  0.9  9428 5120 ?        S    Jun21   0:00 xfs -droppriv -da
daemon     801  0.0  0.1  1428  528 ?        S    Jun21   0:00 /usr/sbin/atd
root       828  0.0  0.0  1368  404 tty1     S    Jun21   0:00 /sbin/mingetty tt
root       829  0.0  0.0  1368  404 tty2     S    Jun21   0:00 /sbin/mingetty tt
root       830  0.0  0.0  1368  404 tty3     S    Jun21   0:00 /sbin/mingetty tt
root       831  0.0  0.0  1368  404 tty4     S    Jun21   0:00 /sbin/mingetty tt
root       832  0.0  0.0  1368  404 tty5     S    Jun21   0:00 /sbin/mingetty tt
root       833  0.0  0.0  1368  404 tty6     S    Jun21   0:00 /sbin/mingetty tt
root       834  0.0  0.1  3336  812 ?        S    Jun21   0:00 /usr/X11R6/bin/xd
root       842  2.1  9.0 114396 46612 ?      SL   Jun21  40:38 /usr/X11R6/bin/X 
root       843  0.0  0.5  8500 2932 ?        S    Jun21   0:00 -:0              
root       858  0.0  0.0     0    0 ?        SW   Jun21   0:00 [rpciod]


You should be concerned about the "RSS" column (number 6 in this
particular sample) -- RSS stands for Resident Set Size and is an
indication of how much of the process is currently present in physical
RAM -- (what you're interested in).

As rssohan mentioned use ps aux to check memory use for each process.
From your "free -m" output you're using a lot of swap space which can
cause a huge slow down on servers and desktop applications. From the
output of free it looks like you have about 8Gb of ram? I'm guessing
this is a server... try checking some of your config files. If limits
for common services like apache or mysql are set to high your system
will chew up all the memory and start "swapping" something that is
very bad for databases or webservers. It's best to start with low
connection limits on these services and increase them as resources
free up than start off high. I hope this helps.