Finding the Process That’s Eating Your System

In the last installment in our current series, we answered the question “Where did my disk space go?”. Now, we will tackle the question:

“Why is this system slow right now?”

When Linux systems feel sluggish, unresponsive, or outright hostile, the root cause is almost always the same. Something is running that should not be, or something is running far harder than expected.

This is not guesswork. Linux gives you direct visibility into what is happening. You just need to ask the right questions.

Stop Watching. Start Investigating.

Most people open top, stare at it for a few seconds, then shrug.

That is not troubleshooting. That is observation without intent.

Your goal is not to see everything. Your goal is to identify the one process that matters right now.


Start With a Snapshot, Not a Stream

Live dashboards are useful, but the fastest answers usually come from a static snapshot you can sort.

This is where ps shines.

ps aux

This command shows every running process, who owns it, and how much CPU and memory it is consuming. On its own, it is noise.

Sorting turns it into signal.

Find the CPU Hog

When the system feels slow or fans are spinning, CPU is usually the first suspect.

ps aux --sort=-%cpu | head

This answers a very specific question: “What is using the most CPU right now?”

No scrolling. No guessing. The worst offender is at the top.

If a process is pegged at 100 percent CPU, you have your culprit!


Find the Memory Hog

If performance degrades over time or services start getting killed, memory pressure is often the cause.

ps aux --sort=-%mem | head

This shows which processes are consuming the most RAM.

This is especially useful for spotting:

  • Memory leaks
  • Runaway Java or Node processes
  • Containers that were never given limits

If a single process is quietly eating half the system memory, it will eventually bring everything else down with it.


Use top When You Need the Story in Motion

Once you know what to look for, top becomes far more useful.

top

Key things that actually matter:

  • CPU usage per process
  • Memory usage trends
  • Load average relative to CPU cores

Sort inside top instead of watching chaos:

  • Press P to sort by CPU
  • Press M to sort by memory

Now you are tracking behavior, not just numbers.


The Pattern You Should Notice

At this point in the series, something important should be clicking.

You are not learning commands. You are learning questions.

  • du asks where space went
  • ps asks who is consuming resources
  • sort decides what matters first

Linux troubleshooting is not about memorizing flags. It is about reducing the problem space until only one answer remains.

What to Do When You Find the Culprit

Finding the process is step 1. Acting responsibly is step 2.

Before killing anything, ask:

  • Should this process be running?
  • Is the load expected for this service?
  • Is this a symptom of something else failing?

Sometimes the fix is restarting a service.

Sometimes it is fixing a configuration.

Sometimes it is discovering software that never should have been installed.

Blindly killing processes fixes symptoms, not systems.


The Command Mindset, Reinforced

If you take one thing from this post, let it be this: Linux commands are sensors.

Sorting is your filter.

Your question determines the value of the output.

Everything else is implementation detail.


Coming Up Next

Now that you know how to find what is consuming disk and CPU, the next real-world question is obvious:

Who is listening on my system, and why?

That is where network-focused commands earn their place.