I recently noticed that something was using up lots of RAM on my Mac, as it would periodically slow down. I had some suspects, but rather than regularly checking in Activity Monitor, I thought it would be more helpful if I had a way to monitor usage of RAM by various processes over time.
Due to previous success with my Splunk Lab app, I decided to use it as the basis for building out a RAM monitoring app. The data acquisition part, however, was trickier. The output of the UNIX ps app isn’t very structured, and I had some problems parsing that data, especially in situations where there were spaces in filenames and arguments to those commands.
So I wrote a replacement for PS. It turns out that Python has a module called psutil, which lets you programmatically examine the process tree on your Mac. I ended up writing an app called Better PS, and it writes highly structured data on each current process to disk, which is then ingested by Splunk.
With those two pieces done, let’s talk about getting this up and running! First, clone the project:
git clone git@github.com:dmuth/mac-osx-ram-usage.git
Then, run the script start-splunk.sh to start Splunk Lab running in a container. The script will tell you what options it is running with, and give you the chance to abort so you can change them:
The next step is to run the script get-ram-loop.sh. If you run this as root, you’ll get information on all processes on the system, otherwise you will only get info on processes owned by yourself (which will be fine in the majority of cases).
Now, you’re ready to go to https://localhost:8000/ and log in with the username “admin” and the password whatever you set it to with start-splunk.sh, and you’ll have the ability to view RAM usage. You can even search by process and exclude strings from the search results:
In the above example, you can see that Docker’s OSX Filesystem driver has… a bit of a memory usage issue until it is restarted, so yeah, that’s interesting.
Have you used this app to find a process on your machine hogging RAM? Let me know in the comments!