Find out which process is using all your CPU or memory on Linux

Check the load average first

Load average shows how many processes are waiting for CPU time, averaged over 1, 5, and 15 minutes. On a system with 4 CPU cores, a load average above 4 means processes are queuing for CPU.

uptime

Check how many CPU cores you have to put that number in context.

nproc

Open top for a live view

top gives you a real-time, auto-refreshing list of processes sorted by CPU usage by default.

top

Inside top, press Shift+M to sort by memory usage instead of CPU, and press Shift+P to go back to sorting by CPU. Press q to quit.

Understand RES vs VIRT

top shows several memory columns that are easy to misread. VIRT is the total virtual memory a process has mapped, including shared libraries and memory it has reserved but not touched. RES is the actual physical RAM the process is using right now, which is the number that matters for diagnosing memory pressure.

List processes with ps aux

ps aux gives you a one-time snapshot of every process, which is easier to pipe, grep, and sort than top's live view.

ps aux

The columns you care about are %CPU, %MEM, RSS (resident memory in KB), and COMMAND.

Sort ps aux by CPU usage

Sort the output by the %CPU column, descending, and show the top 10 processes.

ps aux --sort=-%cpu | head -n 11

The negative sign before %cpu means descending order. Remove it to sort ascending.

Sort ps aux by memory usage

Use the same pattern with %mem to find the biggest memory consumers.

ps aux --sort=-%mem | head -n 11

Filter for a specific process by name

If you already suspect a service, such as nginx or mysqld, filter ps output directly instead of scanning the whole list.

ps aux | grep -i mysqld | grep -v grep

The second grep removes the grep command itself from the results.

Identify zombie and defunct processes

A zombie process has finished executing but its exit status has not been collected by its parent process, leaving an entry in the process table. Zombies do not consume CPU or memory, but a large number of them can indicate a buggy parent process that never calls wait().

ps aux | awk '$8 ~ /Z/ {print}'

If you see zombies, the real fix is restarting the parent process, since you cannot kill a zombie directly, it is already dead and waiting to be reaped.

ps -o ppid= -p <zombie_pid>

Check per-process memory breakdown

For a deeper look at one process, including shared vs private memory, use the proc filesystem.

cat /proc/<pid>/status | grep -E 'VmRSS|VmSize|VmSwap'

Find out which user is running the heaviest processes

Sometimes the question is not which process, but which user or application owns it.

ps aux --sort=-%mem | awk 'NR==1 || NR<=10 {print $1, $2, $3, $4, $11}'

Terminate a runaway process safely

Always try a graceful termination first with the TERM signal, which asks the process to clean up and exit on its own.

kill -15 <pid>

Wait a few seconds and check if it is still running. Only use SIGKILL if the process ignores SIGTERM, since SIGKILL gives it no chance to close files or save state.

kill -9 <pid>

Kill all instances of a process by name

If a process is spawning multiple children, such as a misbehaving script or a leaked worker pool, killall targets every process matching a name.

killall -15 node

As with kill, escalate to SIGKILL only if the processes do not exit within a few seconds.

killall -9 node