Payments are experiencing issues due to temporary restrictions in Russia. If your payment does not go through, please submit a support request.Our support team is available 24/7 — we are always here to help with hosting and server issues.We are now accepting requests for dedicated server rental and colocation services in our data center.Reminder: we recommend enabling backups for additional data protection.A new VPS/VDS lineup with NVMe storage and improved performance is now available.Maintenance work on some servers has been completed. All services are operating normally.
Article4 min readViews0

How to Identify Which Process Is Using Swap in Linux

Safe swap diagnostics in Ubuntu: check active swap regions, read VmSwap for processes, and interpret results correctly without clearing memory.

АльбинаCommunity author★ 107
Comments 0

Server monitor with memory modules and a swap drive, unlabeled
In this article

Swap is in use, yet the server runs normally—this is possible. Linux is not required to immediately return rarely used pages from swap to RAM. The mere fact of non-zero swap usage does not prove memory shortage and does not require disabling swap. First, you must understand the total volume and identify the processes for which the kernel accounts for swapped-out pages.

This guide applies to Ubuntu 24.04 LTS and other modern Linux systems with the procfs file system. The commands only read the system state. They do not clear swap, restart services, or change kernel parameters. Verified on September 25, 2026, against Linux manual pages and smem documentation. The swapon command and VmSwap reads were effectively executed in an isolated Ubuntu 24.04.3 LTS environment with kernel 6.18.44. Since no active swap or installed smem existed on the test stand, only the empty result and availability were verified for them, and the smem sorting syntax was cross-checked with the documentation.

Check if swap is enabled

swapon --show --bytes

The command swapon displays active files and swap partitions. The key --bytes outputs sizes in bytes and simplifies machine comparison. If the table is empty, there is no active swap area; searching for processes with used swap at this moment is pointless.

If swap is enabled, note the total size and the used volume. This is only a starting point: the numbers do not show when pages were swapped out or whether the system is currently under memory pressure.

View the VmSwap field for a single process

The kernel publishes the process state in the file /proc/PID/status. Replace PID with the numeric identifier of an existing process.

grep '^VmSwap:' /proc/PID/status

The field VmSwap shows the volume of anonymous private process data accounted for in swap. The value is given in kilobytes. The file may be inaccessible to a regular user due to permissions or hidepid settings in procfs; this is not a reason to weaken protection.

Collect processes with non-zero VmSwap

If smem is already installed on the system, it collects values per process and sorts them by swap volume. First, ensure the command is available; installing a new package on an overloaded server solely for urgent diagnostics is not necessary.

command -v smem

smem -rs swap -k

The key -r enables reverse sorting, -s selects the field swap, and -k adds convenient unit suffixes. Processes belonging to other users may not be fully visible; if necessary, an administrator with authorized rights must perform diagnostics. If smem is missing, check the selected PID via the field VmSwap or use the server's standard monitoring.

How to read the result

Observation

What this may mean

Next check

Swap is occupied, the list is stable, no errors

Old, rarely used pages remain in swap

View available RAM and current swap activity

Values rise rapidly in a single process

The process is consuming memory or under pressure

Check RSS, limits, and application logs

Many processes with small values

Background unloading of inactive pages

Evaluate the system as a whole; do not terminate processes individually

Swap is full and the site is slowing down

Possible memory shortage or constant disk swapping

Check memory, disk, OOM, and dynamic behavior, then identify the root cause.

The VmSwap field does not equal the process's total virtual memory and does not replace analysis of RSS, cgroup limits, and overall I/O activity. The sum across processes may also not match total swap usage due to accounting specifics and already terminated processes.

What not to do during diagnostics

  • Do not disable swap just to achieve a zero value: returning pages requires RAM and can lead to memory shortages.

  • Do not terminate a process simply because it appears first in the list. Dynamics, the process role, and application symptoms are what matter.

  • Do not change swappiness based on a single snapshot of the system state. First, gather observations over time and identify the actual bottleneck.

  • Do not run heavy procfs traversals too frequently on a large server; for continuous monitoring, use the standard metrics system.

Stop self-diagnosis and involve an administrator if swap is growing simultaneously, the system becomes unresponsive, OOM events appear in the log, or it is unknown which services can be safely limited. In such a state, an attempt to "quickly clear memory" can worsen downtime.

GENERAL IT

Help with your project

GENERAL IT

Read more on this topic

Discussion 0

Share your experience and ask questions. Comments without links appear after editorial review.

No comments yet. Start the discussion.