Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Find the cause in layers: first check whether the VPS is actually under memory pressure, then rank processes by resident RAM, inspect suspicious PIDs, attribute usage to systemd services, and account for cache, shared memory, tmpfs, and kernel allocations. A single process list is only a snapshot; repeated measurements are needed to prove a leak or explain an OOM kill.
Start by proving that RAM is under pressure
Log in to the VPS and run:
free -h
free -wThe free utility reports physical and swap memory using data from /proc/meminfo. The human-readable view (-h) is easier to scan; the wide view (-w) separates cache components that the compact output combines.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Field | What it tells you | How to use it |
|---|---|---|
total |
Installed memory visible to Linux. | Use as the baseline for every other value. |
used |
Memory not counted as free or available by the command’s accounting. | Do not treat this alone as proof of a leak; it includes memory that can be reclaimed. |
free |
Completely unused RAM at that instant. | A low number can be normal when Linux is using RAM for cache. |
buff/cache |
Buffers and filesystem cache that can generally be reclaimed. | Compare it with MemAvailable before blaming a process. |
available (from MemAvailable) |
An estimate of RAM that new applications can use without swapping. | This is the most useful first indicator of remaining headroom. |
Swap |
Configured swap capacity and its current use. | Used swap together with falling available RAM indicates sustained pressure, although occasional swap use is not by itself an OOM diagnosis. |
Linux deliberately fills otherwise idle RAM with filesystem cache. That cache is released when applications need the space, so a VPS can show very little free memory while still having substantial MemAvailable. Conversely, a low MemAvailable value, rising swap use, and slow allocation or swapping are evidence of pressure even if no single process appears enormous.
For a continuously updating view, run:
watch -n 2 free -hRecord the output during the incident rather than relying on one screenful. The first sample tells you the state now; a sequence shows whether availability is recovering, oscillating with workload, or declining steadily.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Rank processes by resident memory
Once the system-wide numbers indicate pressure, find likely user-space consumers:
ps -eo pid,ppid,user,comm,%mem,rss,vsz --sort=-rss | head -n 20This lists the 20 processes with the largest resident set size (RSS). The columns are:
- PID: the process identifier you will use for further inspection.
- PPID: the parent process, useful for recognizing workers launched by a service manager.
- USER: the account that owns the process.
- COMM: the executable name.
- %MEM: the process’s RSS as a percentage of physical RAM.
- RSS: pages currently resident in RAM, normally shown in KiB by
ps. - VSZ: the process’s virtual address-space size, also normally in KiB.
RSS is the useful first ranking because it represents physical pages resident now. VSZ is not a RAM bill: it can include reserved address space, mapped files, and pages that have never been faulted into memory. A process with a very large VSZ may therefore have a modest physical footprint.
You can obtain the same ranking interactively with top. Start it with top, then press Shift+M to order processes by memory. Let the display refresh for several cycles; a process that briefly allocates memory and then releases it is different from one that climbs on every refresh.
Do not add every RSS value and assume the sum is the amount that would be freed by killing all those processes. Libraries and other mappings can be shared between processes, and RSS counts a shared page in each process that maps it. The list identifies candidates, not an exact reclaimable total.
Inspect a suspicious PID without killing it
Choose a PID from the ranking and inspect the kernel’s quick summary:
PID=1234
grep -E '^(Name|VmRSS|VmSize|VmSwap|RssAnon|RssFile|RssShmem):' /proc/$PID/statusReplace 1234 with the real identifier. VmRSS is the resident footprint, VmSize is virtual size, and VmSwap is the amount of that process’s memory currently in swap. The RssAnon, RssFile, and RssShmem lines help distinguish anonymous allocations, file-backed mappings, and shared memory when the kernel exposes them.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
/proc/PID/status is fast and suitable for triage. It is not the most detailed accounting, and some fields are aggregates whose precision can be limited by the way pages are shared.
Use smaps_rollup for an aggregate mapping breakdown
cat /proc/$PID/smaps_rollupsmaps_rollup aggregates the process’s memory mappings in one report. It is slower to read than status, but gives a more useful breakdown of private and shared clean or dirty pages, proportional set size (PSS), swap, and related values when available. PSS divides a shared page among the processes that share it, making it a better basis for estimating a process’s fair share than raw RSS.
Use smaps when one mapping needs explanation
less /proc/$PID/smapssmaps reports every mapping separately. Look for unusually large anonymous regions, large writable mappings, file-backed areas, or shared-memory mappings. This file can be expensive to collect on a busy, memory-constrained VPS, so use it after the quick checks and avoid repeatedly dumping it in a tight loop. Linux kernel documentation lists status, statm, smaps, and smaps_rollup as the process-memory interfaces; the Linux man-pages documentation specifically advises using smaps or smaps_rollup when accurate values are required, because they are slower but detailed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Attribute memory to a service, not just individual workers
Several worker processes may belong to one daemon. Looking at them separately can hide the service that owns the total. On a system using systemd, run:
systemd-cgtop --order=memoryThis orders control groups by memory consumption. A control group (cgroup) can contain a service and all of its child processes, so the view answers a different question from ps: “Which service group is consuming memory?” rather than “Which individual PID has the largest RSS?”
Interpret the result with systemd’s accounting caveat: complete accounting requires memory accounting to be enabled for the relevant services. If a group is absent, incomplete, or reports less than expected, do not conclude that the service is harmless until you verify that its memory controller accounting is active and that the processes are actually in that cgroup. Containers and supervisors can also place workloads in nested cgroups, so inspect the hierarchy when a service total does not match the process list.
| View | Scope | Best use | Cost and limitation |
|---|---|---|---|
free -h / free -w |
Whole host | Decide whether RAM and swap are under pressure. | Fast snapshot; does not identify ownership. |
ps or top |
Individual processes | Rank likely user-space consumers. | RSS double-counts shared pages and misses kernel-owned memory. |
/proc/PID/status |
One process | Quick RSS, virtual-size, and swap check. | Aggregate summary, not mapping-level attribution. |
/proc/PID/smaps_rollup |
One process’s mappings | Estimate private, shared, proportional, and swapped portions. | Slower to read; requires access to that PID’s proc entries. |
/proc/PID/smaps |
Each mapping | Find the specific anonymous, file-backed, or shared region. | Most detailed and most expensive of these process views. |
systemd-cgtop |
Service control groups | Attribute a group of workers to a service. | Complete results depend on enabled memory accounting. |
Explain memory that no process appears to own
It is normal for the top 20 RSS values not to add up to the host’s apparent use. Compare the process view with relevant fields in /proc/meminfo:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
grep -E '^(MemTotal|MemFree|MemAvailable|Buffers|Cached|SReclaimable|Shmem|SwapTotal|SwapFree):' /proc/meminfoThese categories commonly account for the remainder:
- Page cache: Linux retains recently read filesystem data in RAM. The
Cachedvalue can be reclaimed when applications need it. - Reclaimable kernel objects:
SReclaimableincludes kernel structures that can often be reclaimed, although not every byte is instantly available. - Shared memory and tmpfs:
Shmemincludes shared-memory objects and tmpfs files. A tmpfs-mounted directory consumes RAM (and potentially swap) even when no process has a correspondingly large private RSS. - Kernel structures: networking buffers, slab allocations, page tables, and other kernel data are not represented as an ordinary user process.
- Shared mappings: libraries and mapped files can be counted in multiple process RSS values while existing only once in physical memory.
- Cgroup effects: a container or service limit can be reached because of the group’s combined anonymous memory, cache, and kernel charges even when host-wide totals look acceptable.
- Swap: pages moved to swap alter the relationship between a process’s resident size and its total allocated memory. Check both per-process
VmSwapand the host’s swap totals.
A low MemAvailable value with substantial cache does not automatically mean the cache is stuck; cache is expected to shrink under pressure. A large and growing Shmem value points you toward tmpfs or shared-memory users rather than an ordinary heap leak. A large kernel or reclaimable component requires a different investigation from killing the highest-RSS application.
Find the process behind an OOM kill
When Linux cannot satisfy an allocation, the kernel’s out-of-memory (OOM) handling can terminate a process. The process killed is not necessarily the process that caused the long-term growth: the OOM selector considers memory usage, privileges, and other factors at the moment of failure. Treat the event log and the preceding trend as one investigation.
Search the kernel journal on a systemd-based VPS:
journalctl -k -g 'oom|out of memory|killed process' --since '2 hours ago'If your journal implementation does not support -g, inspect recent kernel messages with journalctl -k and search for “out of memory,” “oom-kill,” or “Killed process.” On systems without a persistent journal, the same messages may be in the kernel log exposed by the distribution’s logging service.
Capture the PID, command name, cgroup or service, and memory figures printed in the event. Then compare them with:
- The
freeoutput around the event, especiallyMemAvailableand swap. - The process ranking, if you recorded it.
- The service-level result from
systemd-cgtop, when applicable. - Application, scheduler, and web-server logs showing traffic spikes, batch jobs, imports, or a restart loop.
This distinguishes a one-off workload burst from a process whose resident or proportional memory rises after every request or job.
Prove whether usage is growing
A leak is a time pattern, not a large number in one snapshot. Collect the same measurements at a fixed interval and preserve timestamps:
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
while sleep 60; do
date -Is
free -w
ps -eo pid,ppid,user,comm,%mem,rss,vsz --sort=-rss | head -n 20
echo
doneStop the loop with Ctrl+C. For a short incident this gives a lightweight record; redirect it to a file if you need to compare several hours:
while sleep 60; do
date -Is
free -w
ps -eo pid,ppid,user,comm,%mem,rss,vsz --sort=-rss | head -n 20
done >> /tmp/memory-samples.logDo not use a file in a small or nearly full filesystem without checking available disk space. A long-running monitor should be replaced by an appropriately rotated monitoring service rather than an unbounded log.
Correlate each sample with traffic, cron jobs, queues, backups, deployments, and service restarts. A healthy cache may rise during a file-intensive job and fall later. A likely leak shows a process’s private or proportional footprint increasing across comparable workload periods without returning after the work finishes. A restart that resets the number proves only that the process released its memory; it does not identify why it grew.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use a repeatable incident workflow
- Confirm pressure: run
free -handfree -w; noteMemAvailable, cache, and swap rather than readingusedalone. - Capture a baseline: save the timestamp, host totals, and top-process output before restarting anything.
- Rank consumers: use the RSS-sorted
pscommand or sorttopby memory. - Inspect candidates: read
/proc/PID/status, then usesmaps_rolluporsmapswhen shared, anonymous, or file-backed mappings need clarification. - Group workers: run
systemd-cgtop --order=memoryand check whether memory accounting is enabled for the relevant service. - Account for the remainder: compare process and cgroup figures with
Cached,SReclaimable,Shmem, swap, and other/proc/meminfofields. - Check the kernel record: if an OOM kill occurred, identify the killed command and cgroup from kernel messages.
- Measure over time: repeat the snapshots and correlate growth with workload events before deciding that a leak exists.
Only after collecting this evidence should you restart a service, stop a job, or change a memory limit. A restart can relieve an emergency but destroys the state needed to explain the incident.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common interpretation mistakes
“Free memory is almost zero, so the VPS is full”
Check MemAvailable and cache. Linux uses idle RAM for cache and can reclaim much of it. The combination of low available memory, active swapping, allocation failures, or an OOM event is stronger evidence of exhaustion.
“The largest VSZ process is the culprit”
VSZ measures virtual address space, not resident RAM. Sort by RSS first, then inspect PSS and mapping details if shared pages make ownership ambiguous.
“Adding the RSS column gives the exact total”
Shared pages can be counted for several processes. RSS rankings are excellent for finding suspects but cannot by themselves tell you how much memory killing one process would free.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
“No process is large, so the kernel must be leaking”
Check page cache, reclaimable slab, tmpfs and shared memory, swap, and cgroup accounting before making that claim. Those categories are legitimate consumers outside a single user-process RSS line.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall“The process named in the OOM message caused all the growth”
The OOM victim is selected at the failure point. Compare its event details with earlier samples and service-level totals to separate the victim from the workload that created the pressure.
“One measurement proves a leak”
Only repeated comparable snapshots establish a trend. Workload growth, a scheduled job, or normal cache warming can look like a leak in a single sample.
What to record for a useful handoff
If another administrator or developer must diagnose the VPS, provide evidence rather than only saying “RAM is full.” Include:
- The UTC timestamp and VPS distribution or kernel context.
- Several
free -wsamples showing available memory and swap before, during, and after the incident. - The RSS-sorted process list, including PID, parent PID, user, command, RSS, and VSZ.
/proc/PID/statusand, where needed,smaps_rollupfor the leading candidates.- The
systemd-cgtop --order=memoryoutput and whether service memory accounting was enabled. - The relevant
/proc/meminfofields, especially cache, reclaimable memory, shared memory, and swap. - Kernel OOM messages and application or job logs covering the same interval.
Redact secrets from command output and avoid uploading complete process environments or command lines if they contain credentials. These measurements are generally enough to identify whether the owner is an application, a service group, cache or tmpfs, shared mappings, swap, or the kernel.
Bottom line
Use MemAvailable and swap to establish real pressure, RSS to locate likely processes, /proc/PID/status and smaps_rollup to inspect them, and systemd-cgtop to attribute workers to services. Reconcile the remainder with cache, reclaimable kernel memory, tmpfs, shared memory, and cgroups. Then repeat the measurements and compare them with workload and OOM logs; only a time series can distinguish a leak from normal VPS activity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
