> It would probably help to figure out if an app can be blamed with > > ps -el --sort=-size
Attached.
F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY TIME CMD 140 S 33 2587 272 0 61 0 - 19334 semop ? 00:00:00 apache 140 S 33 2588 272 0 60 0 - 18886 semop ? 00:00:00 apache 140 S 33 2589 272 0 60 0 - 18859 select ? 00:00:00 apache 140 S 33 2590 272 0 60 0 - 18859 semop ? 00:00:00 apache 140 S 33 2591 272 0 60 0 - 18859 semop ? 00:00:00 apache 140 S 33 3090 272 0 60 0 - 18859 semop ? 00:00:00 apache 140 S 33 3093 272 0 60 0 - 18859 semop ? 00:00:00 apache 140 S 0 272 1 0 60 0 - 18859 select ? 00:00:00 apache 100 S 100 243 208 0 60 0 - 5928 select ? 00:00:00 mysqld 040 S 100 245 243 0 61 0 - 5928 poll ? 00:00:00 mysqld 040 S 100 246 245 0 60 0 - 5928 rt_sig ? 00:00:00 mysqld 140 S 1000 3098 3096 0 65 0 - 1858 select ? 00:00:00 sshd 140 S 0 3096 258 0 63 0 - 1856 unix_d ? 00:00:00 sshd 100 S 102 206 197 0 60 0 - 691 poll ? 00:00:00 dnscache 140 S 65534 262 1 0 63 0 - 989 select ? 00:00:00 proftpd 000 S 1000 3099 3098 0 74 0 - 725 wait4 pts/0 00:00:00 bash 140 S 0 258 1 0 60 0 - 949 select ? 00:00:00 sshd 000 R 1000 3104 3099 0 79 0 - 899 - pts/0 00:00:00 ps 100 S 0 208 1 0 60 0 - 717 wait4 ? 00:00:00 safe_mysqld 040 S 0 156 1 0 60 0 - 475 syslog ? 00:00:00 klogd 040 S 0 268 1 0 60 0 - 550 nanosl ? 00:00:00 cron 040 S 1 265 1 0 60 0 - 435 nanosl ? 00:00:00 atd 040 S 0 153 1 0 60 0 - 407 select ? 00:00:00 syslogd 140 S 0 162 1 0 60 0 - 510 select ? 00:00:00 authdaemond.pla 040 S 0 164 162 0 60 0 - 510 select ? 00:00:00 authdaemond.pla 040 S 0 165 162 0 60 0 - 510 select ? 00:00:00 authdaemond.pla 040 S 0 166 162 0 60 0 - 510 select ? 00:00:00 authdaemond.pla 040 S 0 167 162 0 60 0 - 510 select ? 00:00:00 authdaemond.pla 040 S 0 168 162 0 60 0 - 510 select ? 00:00:00 authdaemond.pla 140 S 0 175 1 0 60 0 - 487 select ? 00:00:00 couriertcpd 140 S 0 183 1 0 63 0 - 487 select ? 00:00:00 couriertcpd 140 S 0 199 1 0 60 0 - 394 select ? 00:00:00 inetd 100 S 0 1 0 0 60 0 - 370 select ? 00:00:04 init 000 S 0 275 1 0 60 0 - 368 read_c tty1 00:00:00 getty 000 S 0 276 1 0 60 0 - 368 read_c tty2 00:00:00 getty 000 S 0 277 1 0 60 0 - 368 read_c tty3 00:00:00 getty 000 S 0 278 1 0 60 0 - 368 read_c tty4 00:00:00 getty 000 S 0 279 1 0 60 0 - 368 read_c tty5 00:00:00 getty 000 S 0 280 1 0 60 0 - 368 read_c tty6 00:00:00 getty 000 S 0 187 1 0 60 0 - 424 pipe_r ? 00:00:00 courierlogger 100 S 103 207 198 0 60 0 - 367 pipe_r ? 00:00:00 multilog 000 S 0 189 1 0 60 0 - 372 nanosl ? 00:00:00 svscan 000 S 0 179 1 0 60 0 - 421 pipe_r ? 00:00:00 courierlogger 100 S 1 190 1 0 60 0 - 366 pipe_r ? 00:00:00 multilog 000 S 0 197 189 0 60 0 - 362 poll ? 00:00:00 supervise 000 S 0 198 189 0 60 0 - 362 poll ? 00:00:00 supervise 040 S 0 2 1 0 60 0 - 0 bdflus ? 00:00:00 kflushd 040 S 0 3 1 0 60 0 - 0 kupdat ? 00:00:00 kupdate 040 S 0 4 1 0 60 0 - 0 kswapd ? 00:00:00 kswapd 040 S 0 5 1 0 60 0 - 0 contex ? 00:00:00 keventd 040 S 0 6 1 0 60 0 - 0 usb_hu ? 00:00:00 khubd
