Deep Analysis of Linux Process Memory with pmap and smaps: Complete Guide from Tools to Visualization

Tools like top and htop can only tell you how much memory a process is using, but they can't show you how that memory is actually distributed. I developed an online visualization tool to make memory analysis much easier.

What are pmap and smaps?

pmap: The Concise Version of Process Memory Map

pmap is like taking a "family photo" of process memory - it displays all memory mapping regions of a process.

# Display detailed information
pmap -x 1234

A typical pmap output looks like this: [With specific parameters, more columns can be displayed, depending on the specific system type]

1234:   /usr/bin/nginx
0000556f8c000000     1024K r-x-- /usr/bin/nginx
0000556f8c100000        4K r---- /usr/bin/nginx
0000556f8c101000        8K rw--- /usr/bin/nginx
00007f9a80000000   131072K rw---   [ anon ]
00007f9a88000000     8192K rw---   [ anon ]

smaps: The Detailed Version of Process Memory Map

smaps not only tells you where memory regions are located, but also provides detailed information about how much physical memory each region uses, how much is shared, and how much has been swapped out.

# View detailed memory mapping of a process
cat /proc/1234/smaps

# View only specific mappings (e.g., heap memory)
cat /proc/1234/smaps | grep -A 20 "\[heap\]"

smaps output is more detailed:

7f9a80000000-7f9a88000000 rw-p 00000000 00:00 0 
Size:             131072 kB
Rss:               65536 kB
Pss:               65536 kB
Shared_Clean:          0 kB
Shared_Dirty:          0 kB
Private_Clean:         0 kB
Private_Dirty:     65536 kB
Referenced:        65536 kB
Anonymous:         65536 kB
Swap:                  0 kB

Pain Points of Traditional Analysis Methods

Reading raw pmap and smaps output directly is really exhausting. Especially when analyzing large applications, the output can be thousands of lines, and finding useful information is like looking for a needle in a haystack. Moreover:

1. Too much data: A complex application's smaps output can be several MB
2. Non-intuitive format: Plain text number dumps make it hard to quickly spot issues
3. Lack of comparison: Cannot easily compare memory states from different time points
4. Hard to filter: Finding specific types of memory regions requires complex grep commands

ctbots.com: Making Memory Analysis Simple

Due to these pain points, I developed an online memory analysis tool.

Tool URL: https://ctbots.com/en/linux/performance/smaps.html

Core Features of the Tool

1. Automatic Command Generation

The tool can automatically generate collection commands - just follow the guide to copy and execute commands to obtain log files.

2. Data Filtering and Search

You can:

• Filter by memory type (heap memory, stack memory, shared libraries, etc.)
• Filter by size range (e.g., only view regions larger than 100MB)

3. Memory Leak Detection

If you upload data from multiple time points, the tool will automatically compare and highlight regions that may have leaks.

Common Suspicious Points in Memory Issues

These places are most likely to expose problems:

1. Abnormal Growth of Anonymous Memory Regions

# Normally, anonymous memory should be relatively stable
7f9a80000000-7f9a82000000 rw-p 00000000 00:00 0 
Size:              32768 kB
Anonymous:         32768 kB

# Abnormal case: anonymous memory region too large or too many
7f9a80000000-7f9aa0000000 rw-p 00000000 00:00 0 
Size:             524288 kB  # 512MB anonymous memory, suspicious!
Anonymous:        524288 kB

2. Severe Heap Memory Fragmentation

# Normal heap memory should be continuous large blocks
cat /proc/PID/smaps | grep -A 5 "\[heap\]"

# If you see many small heap regions, it indicates severe fragmentation

3. Duplicate Loading of Shared Libraries

# Same library loaded multiple times, wasting memory
/lib/x86_64-linux-gnu/libc-2.31.so
/lib/x86_64-linux-gnu/libc-2.31.so  # Duplicated!

4. High Private_Dirty Ratio

# High Private_Dirty indicates process occupying large amounts of exclusive dirty pages
Size:              65536 kB
Private_Dirty:     60000 kB  # Over 90% ratio, needs attention

5. Abnormal Swap Usage

# If you see large amounts of Swap, it indicates insufficient physical memory
Size:              32768 kB
Rss:                8192 kB
Swap:              24576 kB  # 75% swapped out, high system pressure