Show the top processes by memory usage
Identify which running processes consume the most RAM — for debugging memory pressure, leak hunts, or "what is eating my laptop".
How to show the top processes by memory usage in each shell
ps aux --sort=-%mem | head -11`ps aux` shows USER, PID, %CPU, %MEM, VSZ, RSS, etc. `--sort=-%mem` is GNU-specific (Linux); BSD/macOS `ps` uses `ps aux -m` instead (sort by memory, descending). `head -11` keeps the header + 10 processes. For continuous: `watch -n 1 'ps aux --sort=-%mem | head -11'`. For RSS in human units (GNU only): `ps aux --sort=-rss -o pid,user,rss,command | awk '{$3=$3/1024 "M"; print}' | head -10`.
ps aux --sort=-%mem | head -11Same external. For an interactive view (refreshes, allows kill/renice/sort), `htop` (cross-platform, `brew install htop`) or `glances` (Python, has JSON / web UI). On a remote SSH session without htop, `top -o %MEM` (sort by memory) is everywhere — quit with `q`.
ps aux --sort=-%mem | head -11Same external. Fish-flavored capture: `set top_procs (ps aux --sort=-%mem | head -11)`. For arithmetic on the output, awk handles tab-vs-space columns more robustly than fish's string-splitting: `ps aux --sort=-%mem | awk 'NR<=11 { print $4"% "$11 }'`.
Get-Process | Sort-Object WS -Descending | Select-Object -First 10 Name, Id, @{N="WS_MB"; E={[int]($_.WS/1MB)}}`WS` (Working Set) is the closest pwsh equivalent to Linux `RSS` — actual physical RAM consumed. `VM` (Virtual Memory) is closer to `VSZ`. The computed property `@{N="WS_MB"; E={...}}` renames `WS` to a human-friendly MB column. For tracking changes over time: `while ($true) { Get-Process | Sort-Object WS -Descending | Select -First 5 | Format-Table; Start-Sleep 2 }`. For per-process memory breakdown (private, shared): `Get-Counter "\Process(*)\Private Bytes"`.
tasklist /v /fo table | sort /R /+65`tasklist /v` is the verbose form (includes memory). `/fo table` keeps the columnar format. `sort /R` is reverse-order; `/+65` sorts starting at column 65 (where Mem Usage typically lives — verify with `tasklist /v | head -2`). Memory units: `tasklist` reports in KB (e.g. `45,000 K`). For a cleaner pwsh-equivalent: `powershell -NoProfile -Command "Get-Process | Sort-Object WS -Desc | Select -First 10"`. For interactive: open Task Manager (`taskmgr`) — Details tab + sort by Memory column.
Equivalents listed for Bash, Zsh, Fish, PowerShell, cmd.exe.
Gotchas & notes
- RSS (Resident Set Size) is RAM ACTUALLY in physical memory right now. VSZ (Virtual Size) is the total virtual address space the process has mapped (includes file-backed pages not loaded, anonymous mappings not touched yet, etc) — typically MUCH larger than RSS and not a good "memory used" metric. PSS (Proportional Set Size, Linux-only) divides shared memory across processes that share it — the most honest "this process's share of RAM" number. View with `cat /proc/<pid>/smaps_rollup` or `pmap -X <pid>`.
- pwsh `WS` (Working Set) vs `VM` (Virtual Memory) — `WS` is the equivalent of Unix RSS. Newer pwsh also exposes `PrivateMemorySize64` (similar to Linux PSS — memory that's not shared) — useful for distinguishing "process is genuinely using 2GB" from "process maps 2GB of shared DLLs".
- For applications using lots of `mmap`-backed file-cache (databases, search engines), RSS inflates by the size of the cache — but that memory is RECLAIMABLE by the kernel under pressure. A 16GB Postgres process at "16GB RSS" might be reclaimable to ~2GB if needed. Linux `top` shows this in the `SHR` column (shared, file-backed). Don't panic-OOM a process based on RSS alone if SHR is most of it.
- For container workloads (Docker, Kubernetes), the host-level `ps`/`top` shows ALL processes across all containers. To see just one container: `docker top <container>` or `docker stats` (live memory + CPU). Inside the container, `ps aux` is limited to that container's PID namespace and shows only its own processes. Kubernetes: `kubectl top pod` (requires metrics-server installed).