On a Debian Linux 3.16 machine, I have 244 MB of swap space used:

# free -h
             total       used       free     shared    buffers     cached
Mem:           94G        36G        57G       1.9G       3.8G        11G
-/+ buffers/cache:        20G        73G
Swap:         487M       244M       243M

Looking at this, I cannot find 244 MB used.

# for file in /proc/*/status ; do grep VmSwap $file; done | sort -nk 2 | tail
VmSwap:        0 kB
VmSwap:        0 kB
VmSwap:        0 kB
VmSwap:        0 kB
VmSwap:        0 kB
VmSwap:        0 kB
VmSwap:        4 kB
VmSwap:       12 kB
VmSwap:       16 kB
VmSwap:       36 kB

And I only have 34 MB of SwapCached:

# grep -i swap /proc/meminfo
SwapCached:        34584 kB
SwapTotal:        499708 kB
SwapFree:         249388 kB

Kernel doc says about this:

SwapCached: Memory that once was swapped out, is swapped back in but still also is in the swapfile (if memory is needed it doesn't need to be swapped out AGAIN because it is already in the swapfile. This saves I/O)

How can I know which process is using my swap space on my Linux system? More precisely: Where are consumed each of those 244 MB of swap?

  • SwapCached can also be seen as stuff that was swapped out, and was later needed. And you don't have much swapped out, and can not have much swapped out. Why do you have a swap space at all? Jul 23, 2018 at 12:24
  • @ctrl-alt-delor Without any swap space, I've seen many processes just crash "randomly". So I think that's a nice safety even if you have a lot of RAM. Oct 9, 2020 at 17:02

3 Answers 3


How can I know which process is using my swap space on my Linux system?

Swap space is not necessarily used by specific processes.

More precisely: Where are consumed each of those 244 MB of swap?

Files stored on tmpfs based file systems might be using them (tmpfs first uses RAM as back-end but, not to waste RAM, can paginate out to the swap area blocks that are not actively used).

Check the output of :

df -ht tmpfs
  • 1
    This is the answer which applies for me! Is there a way to know how much of this tmpfs storage is currently in the swap space? Maybe it can be inferred from /proc/meminfo. (?)
    – Totor
    Aug 8, 2018 at 14:46
  • I don't understand how the output of df -ht tmpfs could help with determining that it uses swap space. Also in my case, most just use a mere 1% of the available space which I would imagine is not going to be swapped out? Oct 9, 2020 at 17:00
  • @AlexisWilke tmpfs stores its content in virtual memory. Virtual memory is a combination of RAM and disk, more precisely of page cache and swap area. If there are files in such file systems and if these files are seldom used, regardless of whether they use 1% or more of the available space, the OS might rightly decide to move their content from the page cache to the swap area. There is no point to waste RAM with unused data.
    – jlliagre
    Oct 9, 2020 at 20:41
  • That doesn't answer my question, though. The df command is not going to tell me whether the tmpfs module decided to swap some data to disk. I would think there isn't really a way to know. Oct 10, 2020 at 6:53
  • 1
    @AlexisWilke There are definitely cases where you can be sure some of the tmpfs used data is stored on swap area pages. There is also an indirect method, more or less convenient depending on the machine activity. Just read the files stored in tmpfs. If that triggers disk activity, some or all content was on disk. Of course, this is a "destructive" test because at the end, the data will tend to stay on RAM, at least momentarily.
    – jlliagre
    Oct 10, 2020 at 13:47

The /proc/PID/smaps is an extension based on maps, showing the memory consumption for each of the process's mappings. For each of mappings there is a series of lines such as the following:

08048000-080bc000 r-xp 00000000 03:02 13130      /bin/bash
Size:               1084 kB
Rss:                 892 kB
Pss:                 374 kB
Shared_Clean:        892 kB
Shared_Dirty:          0 kB
Private_Clean:         0 kB
Private_Dirty:         0 kB
Referenced:          892 kB
Anonymous:             0 kB
LazyFree:              0 kB
AnonHugePages:         0 kB
ShmemPmdMapped:        0 kB
Shared_Hugetlb:        0 kB
Private_Hugetlb:       0 kB
Swap:                  0 kB
SwapPss:               0 kB
KernelPageSize:        4 kB
MMUPageSize:           4 kB
Locked:                0 kB
VmFlags: rd ex mr mw me dw



for proc in /proc/*; do
    if [[ ! "${proc}" =~ /proc/[0-9]+/* ]]; then

    executable=$(readlink "${proc}/exe" | awk '{print $1}')
    awk -v executable="${executable}" \
        -v SWAP_FIELD="${SWAP_FIELD}" \
        '$0~SWAP_FIELD{swap+=$2}END{print swap"\tKiB\t"executable}' < "${proc}/smaps";
done |\
    sort -n |\
    awk '{total+=$1}/[0-9]/;END{print total "\tKB\tTotal"}'

Example output:

0       KB      /usr/bin/bash
0       KB      /usr/bin/bash
0       KB      /usr/bin/bash
0       KB      /usr/bin/bash
0       KB      /usr/bin/bash
0       KB      /usr/bin/docker-containerd
0       KB      /usr/bin/docker-containerd-shim
0       KB      /usr/bin/docker-containerd-shim
0       KB      /usr/bin/docker-proxy
0       KB      /usr/bin/docker-proxy
0       KB      /usr/bin/docker-proxy
0       KB      /usr/bin/gawk
0       KB      /usr/bin/readlink
0       KB      /usr/bin/sleep
0       KB      /usr/bin/sort
0       KB      /usr/bin/ssh
0       KB      /usr/bin/ssh
0       KB      /usr/bin/ssh-agent
0       KB      /usr/libexec/postfix/pickup
0       KB      /usr/libexec/postfix/qmgr
0       KB      /usr/sbin/atd
0       KB      /usr/sbin/dnsmasq
0       KB      /usr/sbin/dnsmasq
0       KB      /usr/sbin/sedispatch
0       KB      /usr/sbin/sshd
0       KB      /usr/sbin/sshd
28      KB      /usr/sbin/chronyd
32      KB      /usr/sbin/audispd
84      KB      /usr/sbin/avahi-daemon
88      KB      /usr/lib/systemd/systemd-logind
100     KB      /usr/bin/tail
104     KB      /usr/sbin/crond
156     KB      /usr/sbin/avahi-daemon
192     KB      /usr/lib/systemd/systemd-journald
196     KB      /usr/bin/bash
196     KB      /usr/bin/dbus-launch
14872   KB      /usr/bin/Xvnc
20048   KB      /usr/lib64/firefox/firefox
40176   KB      /usr/lib64/firefox/firefox
108848  KB      /usr/sbin/mysqld
267144  KB      Total

This actually says mysql is using the most swap.

$ free -k
              total        used        free      shared  buff/cache   available
Mem:        1883740     1044212      112132       14320      727396      520304
Swap:       2097148      265784     1831364

free's ouput doesn't seem too much off in my case

  • 1
    Your command gave exactly the same result as mine (using status or smaps didn't show a real difference). Alas, your answer doesn't help me to understand what is using my swap space. :(
    – Totor
    Jul 17, 2018 at 15:21
  • 1
    I am pretty much sure this answers "How can I know which process is using my swap space on my Linux system?", the answer for my system is mysqld. Maybe you should reformulate the question, if you are asking something diffrent?
    – Ezwig
    Jul 17, 2018 at 16:52
  • 1
    "What is consuming 244 MB of swap?" would be a more precise question in my case. I want to know where those MB are consumed. I will update my question to be more specific.
    – Totor
    Jul 23, 2018 at 11:58

This will print each PID that currently use swap memory:

for pid in $(ls /proc/ | grep -Po '^\d+$'); do echo -n "$pid "; cat /proc/$pid/status | grep VmSwap; done | grep -vE '  0 kB$' | grep -Eo '[0-9]+ VmSwap:.+' | sed -r 's/VmSwap://g'
  • 1
    ... and all processes whose name simply contains swap, as in kswapd.
    – AdminBee
    Oct 21, 2021 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.