Linux: top memory and CPU consuming processes (ps, sar, scripts, metrics file)

Admins usually want two different answers: who is hot on CPU right now, and who is holding RAM. The same data also feeds linux cpu utilization history when you sample over time (this is where sar and log files help). For per-process RSS and maps, the deeper dive is in check memory usage per process in Linux.

I re-ran every command shown below on Ubuntu 25.04, kernel 6.14.0-37-generic, Bash 5.2.37. To push realistic numbers, I used the stress tool from the stress package (sudo apt install stress on Debian/Ubuntu): short CPU workers (stress --cpu 2) and memory workers that hold pages (stress --vm 3 --vm-bytes 200M --vm-keep). Stop any test if your laptop fans spin up or you are near memory limits.

Top CPU consuming process in Linux (ps after a CPU spike)

While stress --cpu 2 --timeout 5s was running, a plain sort on %CPU looked like this on my box (your absolute numbers will differ, but the shape is typical: the load generator and a few always-on daemons float to the top):

COMMAND         %CPU
ps               166
stress          82.7
stress          77.2
hugo            40.1
kube-apiserver  15.1
kube-apiserver  14.7
kube-apiserver  13.5

Command used:

ps -eo comm,pcpu --sort=-pcpu | head

That answers how to check top 10 cpu consuming process in linux in the simplest way: widen head to head -15 or use top / htop interactively (Shift+P sorts by CPU in top). For cpu utilization in linux by a process over an interval, see pidstat below.

Top memory consuming process in Linux (ps during a memory hold)

With stress --vm 3 --vm-bytes 200M --vm-keep --timeout 20s, three workers stayed resident near 200 MB RSS each, which shows up clearly against other daemons:

COMMAND         %MEM   RSS
hugo            22.4 1944104
node             3.8 332800
kube-apiserver   2.9 257196
kube-apiserver   2.8 251200
kube-apiserver   2.4 208504
stress           2.3 205624
stress           2.3 205624
stress           2.3 205624
node             1.7 150744
gnome-shell      1.5 130104

Command:

ps -eo comm,pmem,rss --sort=-pmem | head

RSS is resident set: a good first answer to check memory usage of a process in linux and check which process is consuming memory linux. VSS (VSZ) is larger and includes mappings that are not actually in RAM—do not rank purely on VSZ unless you know why.

Linux CPU utilization history with sar

sar reads kernel statistics; with the sysstat service enabled it can also read back from daily data files (sar -f /var/log/sysstat/saDD). For a live two second CPU snapshot during load:

Linux 6.14.0-37-generic (server1) 	06/13/2026 	_x86_64_	(3 CPU)

01:26:14 PM     CPU     %user     %nice   %system   %iowait    %steal     %idle
01:26:16 PM     all     40.91      0.00     59.09      0.00      0.00      0.00
01:26:18 PM     all     29.86      0.00     42.65      0.00      0.00     27.49
Average:        all     34.11      0.00     48.98      0.00      0.00     16.91

Command:

sar -u 1 2

For linux cpu usage per process style history, pidstat -u (below) or logging ps/pidstat to a file pairs well with sar for machine-wide context. More sar recipes live in sar command in Linux.

CPU usage per process over an interval (pidstat)

pidstat -u 1 2 prints per-PID user/system/total %CPU for two one-second buckets. It is ideal when you care about linux cpu usage per process rather than only the global %idle line:

Linux 6.14.0-37-generic (server1) 	06/13/2026 	_x86_64_	(3 CPU)

01:27:29 PM   UID       PID    %usr %system  %guest   %wait    %CPU   CPU  Command
01:27:30 PM     0      3286    2.56    5.98    0.00   11.11    8.55     0  kubelet
01:27:30 PM     0      6264    3.42    5.13    0.00    0.00    8.55     2  kube-apiserver

Install on Ubuntu: sudo apt install sysstat (ships sar and pidstat).

Bash script: monitor process resources and store metrics in a file

The pattern behind bash script monitor process resources usage store metrics file is: append a timestamped snapshot on a fixed interval, then aggregate. Below, METRICS is a CSV-friendly line: epoch, hostname, then ps output. Tune SECS and UNIT_TIME; for a quick dry run use SECS=60 before committing to an hour.

CPU log

#!/usr/bin/env bash
set -euo pipefail

METRICS=${METRICS:-/var/tmp/cpu-metrics.csv}
SECS=${SECS:-3600}          # total window
UNIT_TIME=${UNIT_TIME:-10} # sampling interval

steps=$(( SECS / UNIT_TIME ))
echo "Logging top CPU lines to $METRICS every ${UNIT_TIME}s for ${SECS}s (Ctrl+C stops early)"

for ((i = 0; i < steps; i++)); do
  printf '%s,%s,' "$(date -Iseconds)" "$(hostname -s)"
  ps -eo pid,comm,pcpu --sort=-pcpu | head -11 | paste -sd';' -
  echo
  sleep "$UNIT_TIME"
done >>"$METRICS"

Memory log — same idea with %mem and rss:

#!/usr/bin/env bash
set -euo pipefail

METRICS=${METRICS:-/var/tmp/mem-metrics.csv}
SECS=${SECS:-3600}
UNIT_TIME=${UNIT_TIME:-10}

steps=$(( SECS / UNIT_TIME ))
echo "Logging top memory lines to $METRICS every ${UNIT_TIME}s for ${SECS}s"

for ((i = 0; i < steps; i++)); do
  printf '%s,%s,' "$(date -Iseconds)" "$(hostname -s)"
  ps -eo pid,comm,pmem,rss --sort=-pmem | head -11 | paste -sd';' -
  echo
  sleep "$UNIT_TIME"
done >>"$METRICS"

Using pid avoids losing detail when several threads share the same comm name. If you still aggregate by comm with awk, remember multiple PIDs collapse into one label—fine for a quick chart, wrong for JVM tuning.

Monitor CPU usage and send email alerts in Linux (outline)

A minimal monitor cpu usage and send email alerts in linux approach is cron + threshold:

1. Pick a probe (for example ps -eo pcpu= --sort=-pcpu | head -1 for the hottest %CPU line, or parse your metrics CSV).
2. If the value exceeds a limit, call mail / sendmail (package mailutils on Ubuntu).
3. Rate-limit alerts (last_alert file with timestamp) so a stuck runaway process does not email you every minute.

Pseudo-check inside a script:

max=$(ps -eo pcpu= --sort=-pcpu | head -1 | tr -d ' ')
awk -v m="$max" 'BEGIN{exit !(m+0 > 85)}' && echo "CPU hot: ${max}%" | mail -s "CPU alert $(hostname -s)" you@example.com

Wire that to cron only after you have tested the mail path interactively.

Related tuning

• Threads vs PIDs: check threads per process in Linux.
• Cap CPU for services with cgroups: cgroup limit CPU usage.
• Disk bottlenecks that look like CPU wait: monitor disk IO performance.

Summary

For top memory consuming process in linux and top cpu consuming process in linux, start with ps --sort=-pcpu or ps --sort=-pmem and confirm with RSS for RAM. For linux cpu utilization history, use sar -u (and archived sa* files once sysstat is collecting). For linux cpu usage per process over time, prefer pidstat -u or append ps -eo pid,comm,pcpu lines to a metrics file on an interval—the scripts above are a small, auditable pattern you can extend before adding email alerts and dashboards.