I had this situation recently when Apache got high load, ate all the remaining RAM and started to consume SWAP too. If you ever experienced this you may already know that this is mad spiral that usually brings the system down and only power cycling can restore it to order.

Of course some changes to server’s configuration will be needed to avoid situation like this in future – applications allowed to use more memory that system actually has – but now all we want is to restart what we can to recover some RAM, SWAP (especially SWAP) and save it from restart.

And here I found my self not knowing what actually is using SWAP – ‘top’ is not going to tell me this, neither will ‘ps’, but there is a place that holds this information.

This place is ‘/proc/XXXX/smaps’ – where XXXX insert PID of process that you’re interested in.

So to get quickly sum you could write this:

SUM=0;for SWAP in $(grep Swap /proc/515/smaps | awk ‘{print $2}’); do let SUM=$SUM+$SWAP; done; echo $SUM;

But lets get process name as well so it makes more sense, this is how I’ve amended the line from above:

PID=515;SUM=0;for SWAP in $(grep Swap /proc/$PID/smaps | awk ‘{print $2}’); do let SUM=$SUM+$SWAP; PROCNAME=$(ps -p $PID -o comm –no-headers); done; echo “Swap used by $PROCNAME: $SUM”

So PID of process comes as first and then we have PROCNAME=$(ps -p $PID -o comm –no-headers); to get us the name of process hiding under that PID.

Of course there is no much use of it at this stage as you’d need to go PID by PID to find out which uses most of Swap – you need a loop that will go through all processes in /proc folder.

Hopefully you’ll find this helpful as I did.