How can I find out processes are using swap space?

Solution 1:

It is possible that multiple programs will be using the same swap area, so it will be reported twice.

There is no need to try to tell Linux to use the buffered area instead of swap--it's already very smart about what it's doing. If you're using 9gb of swap and 9gb of buffer, that's a good thing... that means Linux realizes that 9gb of stuff loaded into memory isn't being used actively, so it's more efficient to swap it to disk so that your buffer can grow larger, and improve your performance.

EDIT: If you add up all of the memory used by each process, you'll get much more than your physical RAM, too. This is due to shared libraries being used by multiple programs, as well as the way Linux handles forks--it doesn't duplicate the entire program in memory, it only duplicates the portions that differ between the two instances. In some cases, video memory can be shown as part of an X process--I think the old Voodoo3 cards did this. There may be other cases where "phantom" memory can show up in top, as well.

Solution 2:

Parsing the /proc subdirectory works:

As a bash script:

for PROCESS in /proc/*/; do
  swapused=$(awk 'BEGIN { total = 0 } /^Swap:[[:blank:]]*[1-9]/ { total = total + $2 } END { print total }' ${PROCESS}/smaps 2>/dev/null || echo 0)
  if [ $swapused -gt 0 ]; then
    /bin/echo -e "${swapused}k\t$(cat ${PROCESS}/cmdline)"
  fi
done

Output could be sorted Hi-Lo by piping to sort:

{blah}| sort -rn

Of course, rewrite this in your favorite language-of-the-week as you desire. My Awk-fu is not strong.

(cut-n-pastable)

#!/bin/bash
#
# show swap used by processes
#
(for PROCESS in /proc/*/; do
  swapused=$(awk 'BEGIN { total = 0 } /^Swap:[[:blank:]]*[1-9]/ { total = total + $2 } END { print total }' ${PROCESS}/smaps 2>/dev/null || echo 0)
  if [ $swapused -gt 0 ]; then
    /bin/echo -e "${swapused}k\t$(cat ${PROCESS}/cmdline)"
  fi
done ) | sort -nr

Solution 3:

for file in /proc/*/status ; do awk '/VmSwap|Name/{printf $2 " " $3}END{ print ""}' $file; done | sort -k 2 -n -r | less

from: http://www.cyberciti.biz/faq/linux-which-process-is-using-swap/