How to Check Which Process Is Using the Most Memory on a Mac in Terminal

If your Mac feels slow, apps are freezing, or you see a low-memory warning, Terminal can show which processes are using the most memory. The quickest command is:

top -o mem

This opens a live process list sorted by memory use, with the highest memory users near the top. Press Control-C to stop the display and return to the command prompt.

A process is a running app, background service, or system task. In Terminal, memory is often labeled MEM, RES, or RSS, depending on the command you use.

Quick Answer

1. Open Terminal from Applications > Utilities.
2. Run:

bash
top -o mem

3. Look near the top of the process list for the largest memory values.
4. Press Control-C when finished.

For a one-time, easier-to-read list instead of a continuously updating display, run:

ps -axo pid,comm,%mem,rss | sort -k4 -nr | head -11

This lists the process ID, command name, percentage of memory, and resident memory size. The first line is a header, followed by up to 10 processes using the most resident memory.

top -o mem

Check Memory Use Live with top

The top command is useful when you want to watch memory use change while an app is running or when the Mac is slowing down.

1. Open Terminal

Open Finder, select Applications in the sidebar, open Utilities, and then open Terminal.

You can also press Command-Space, type Terminal, and press Return.

2. Start a memory-sorted process list

Enter this command and press Return:

top -o mem

top displays currently running processes and refreshes the information repeatedly. The -o mem option tells it to sort the process list by memory use.

The exact layout can vary between macOS releases and Terminal windows, but you will generally see columns such as:

• PID: The process ID, a number assigned to the running process.
• COMMAND: The process or executable name.
• %CPU: The percentage of processor capacity being used.
• %MEM: The percentage of physical memory associated with the process.
• TIME: The amount of processor time used.
• RSS or another memory-related field: The process’s resident memory, meaning memory currently held in RAM.

The process list may move as memory usage changes. Focus on processes that remain near the top rather than a process that appears briefly.

3. Stop the live display

When you have identified the likely memory-heavy process, press:

Control-C

This stops top. It does not terminate the process being displayed and does not change your Mac’s settings.

Create a One-Time Memory Report

A snapshot is easier to compare and copy than a continuously updating screen. The following command sorts processes by resident memory and displays the top 10 entries:

ps -axo pid,comm,%mem,rss | sort -k4 -nr | head -11

What each part does:

• ps -axo pid,comm,%mem,rss collects process information.
• -a includes processes associated with all users that the command can list.
• -x includes processes without a traditional terminal.
• -o selects the columns to display.
• pid shows the process ID.
• comm shows the command name.
• %mem shows the percentage of memory associated with the process.
• rss shows resident memory, usually reported in kilobytes by ps.
• sort -k4 -nr sorts the fourth column, rss, numerically from largest to smallest.
• head -11 keeps the header plus the first 10 process entries.

The command only reads system information. It does not stop apps, change settings, or delete files, so no reversal is needed.

Read the results

You may see output shaped like this:

  PID COMMAND          %MEM      RSS
  ...

The actual process names and values will depend on what is running on your Mac. Look at the first process after the header and compare its RSS value with the entries below it.

Resident memory is useful for comparing processes, but it is not the same as the amount of memory an app appears to use in every macOS tool. macOS may share memory between processes, compress memory, and manage cached data automatically. Treat the list as a way to find candidates for investigation, not as a complete diagnosis by itself.

ps -axo pid,comm,%mem,rss | sort -k4 -nr | head -11

Show Memory in a More Readable Format with ps

The previous command reports RSS as a number. You can ask ps for a wider set of fields, including virtual memory and resident memory:

ps -axo pid=,comm=,%mem=,rss=,vsz= | sort -k4 -nr | head -10

This version suppresses the header, so the output contains only process rows. The fields are:

• pid=: Process ID without a column heading.
• comm=: Command name without a heading.
• %mem=: Memory percentage.
• rss=: Resident memory.
• vsz=: Virtual memory size.

rss is usually the most useful field here for comparing how much physical memory a process currently occupies. vsz represents the process’s virtual address space and should not be treated as the amount of RAM it is actively using.

Because this command only reads and sorts process information, it does not require a recovery step.

If you prefer to keep the headings, use the earlier ps command instead.

Find More Details About a Specific Process

Once you identify a process ID, you can inspect that process directly. Replace 1234 with the PID you found:

ps -p 1234 -o pid,ppid,user,%cpu,%mem,rss,etime,command

This displays:

• The process ID
• Its parent process ID
• The user account running it
• CPU and memory percentages
• Resident memory
• Elapsed running time
• The full command where available

This command does not stop or modify the process. If the process has already ended, ps may return no process information.

A process name may not match the name of the app window you recognize. For example, a browser, development tool, or media app may use several helper processes. Check whether multiple related processes are using memory before deciding that one entry explains the entire problem.

Identify the App Behind a Process

If you have a PID and want to see which application bundle owns it, use:

ps -p 1234 -o command=

Replace 1234 with the actual PID. This prints the command associated with that process without changing anything.

You can also use Activity Monitor to investigate the same process graphically. Open Activity Monitor from Applications > Utilities, select the Memory tab, and click the Memory column to sort it. Activity Monitor provides additional information such as memory pressure and swap usage, while Terminal is convenient for a quick text-based check.

Do Not Kill a Process Just Because It Uses Memory

A large memory value does not automatically mean a process is malfunctioning. Some apps legitimately need more memory while handling large files, browser tabs, virtual machines, photos, video, or other demanding tasks.

Avoid ending a process unless you understand what it is and what will happen. Force-quitting or terminating an app can cause unsaved work to be lost.

If you recognize the process as an app you opened:

1. Save your work.
2. Quit the app normally using Command-Q.
3. Recheck memory use with top or ps.

If the app does not respond, use Option-Command-Escape to open Force Quit Applications. Select the unresponsive app and choose Force Quit. Any unsaved work in that app may be lost.

Terminating a process from Terminal

Only use this when normal quitting is not working and you understand the process. First try a normal termination signal with the process ID:

kill 1234

Replace 1234 with the correct PID. This asks the process to exit cleanly. It changes system state by stopping that process, so save work first.

If the process does not exit, a forceful command is available:

kill -9 1234

This immediately terminates the process and gives it no opportunity to save data or clean up. It can cause data loss or leave temporary work incomplete. Use it only as a last resort.

There is no universal reversal command for a terminated process. You can usually reopen an app from Applications, but a background service may be restarted automatically, require a logout or restart, or need the software that installed it to be opened again. If you are unsure what a process does, do not terminate it.

ps -p 1234 -o pid,ppid,user,%cpu,%mem,rss,etime,command

Troubleshooting

top: illegal option or an unexpected result

Command options can differ between Unix systems. Make sure you are using the command exactly as shown:

top -o mem

If the display does not sort as expected, use the one-time ps report instead:

ps -axo pid,comm,%mem,rss | sort -k4 -nr | head -11

The process list changes too quickly

That is normal for a live display. Stop top with Control-C, then run the snapshot command. A snapshot gives you a fixed list that is easier to read and compare.

The largest process is a system process

Do not terminate an unfamiliar system process solely because it appears near the top. System services can temporarily use memory during normal operation. Note the process name, observe it for a few minutes, and check whether memory use continues to rise.

If the Mac remains slow, save your work and restart the affected app or the Mac. A restart ends running processes, so close apps normally first and be aware that unsaved work can be lost if an app is unresponsive.

Memory usage looks high even after closing an app

macOS may retain cached data or use memory compression. High memory use by itself does not prove there is a problem. Check whether the Mac is actually slow, whether apps are displaying warnings, and whether the same process repeatedly grows after being reopened.

Activity Monitor’s Memory tab can provide additional context, including memory pressure. For broader Mac hardware checks, see How to check Mac hardware information in Terminal.

You get “Operation not permitted”

Some process details may be restricted by macOS privacy and security protections. Do not bypass those protections just to inspect an unfamiliar process. You can still use the information that the command is allowed to display, and Activity Monitor may provide a different view.

A process disappears before you can inspect it

The process may have ended normally, restarted with a new PID, or been replaced by a helper process. Run the snapshot again or use top to watch for a recurring process name.

Frequently Asked Questions

What is the fastest Terminal command for finding the biggest memory user?

Run:

top -o mem

The live list is sorted by memory use. Press Control-C to stop it.

What is the best command for a one-time list?

Use:

ps -axo pid,comm,%mem,rss | sort -k4 -nr | head -11

It sorts processes by resident memory and shows the top 10 entries.

Does a high %MEM value mean the process is broken?

No. A process may use substantial memory because it is performing legitimate work. Investigate repeated growth, slow performance, freezes, or memory warnings rather than relying on one value.

Can I close the process from Terminal?

Yes, but only after saving work and identifying it correctly. Try quitting the app normally first. If necessary, kill PID requests a clean exit; kill -9 PID forcefully ends it and may cause data loss.

What is the difference between memory and storage?

Memory is temporary working space used by running processes. Storage is the long-term space used for files and apps. These commands report process memory, not available storage space.

Should I run Apple Diagnostics for high memory use?

Apple Diagnostics is intended to check certain hardware issues, while these Terminal commands show which processes are using memory. If you suspect a broader hardware problem, you can follow How to Run Apple Diagnostics on a Mac.

Final Thoughts

Use top -o mem for a live view and the sorted ps command for a readable snapshot. Look for processes that consistently use substantial memory and relate the results to actual symptoms such as slow apps or memory warnings. Avoid terminating unfamiliar processes, and save your work before quitting or force-quitting anything.