mjhjmtu

I have a scenario where I can see there is paging activity on my Ubuntu 16.04 laptop using vmstat 1 100.

Due to the sheer size of the current load it is expected that processes are more or less swapped out to disk which is fine. I would, however, like to identify those that cause pages to swapped in all the time (as identified by vmstat) as this might indicate that memory allocation could be improved.

My sysadmin skills are a bit rusty but I am comfortable in a root shell.

What commands should I use to identify the processes which are causing swapping activity?

With performance problems (e.g. high CPU iowait times) it's generally best to monitor these things over time rather than after the fact, especially when short-lived processes might be the culprit. On Linux one tool you can use interactively is iotop (fixed link) (see also the answers to this question about tracking disk I/O). You can script this (batch mode) or run it interactively like top, use the cursor keys to sort by SWAPIN, or use the -o option so the output isn't so cluttered. You will need Python ≥2.7 and various kernel configuration parameters enabled (see iotop's README or man page).

Rather than use only data from /proc like vmstat, iotop uses taskstats, this uses netlink IPC to efficiently provide process accounting directly from the kernel to user space.

On most flavours of Linux with the default "swappiness" setting of 60, it's fairly normal to see paging activity when the system is moderately busy: the kernel is pre-emptively writing little-used process pages to swap instead of purging more recently used disk cache pages. (There's a related parameter vfs_cache_pressure to tune some cacheing behaviour.) If you observe persistent ongoing paging, then there is likely more to it than just this.

Otherwise, if you are concerned about swap use right now rather than over time: the kernel keeps track of swap use per process in /proc/PID/status. You can do something quick with gawk (≥v4.0):

gawk '/^Name:/nm=$2 /^Pid:/pid=$2 /^VmSwap:/sw=$2 
 ENDFILEprintf("%-24s %6i %6ikiBn",nm,pid,sw)' /proc/[0-9]*/status | 
sort -h -k 3

According to the documentation shmem (shared memory) that's swapped out is not counted here, but you hopefully won't need to care about that. Eric Ljungstrom's getswap.sh script can also be used, there's a more advanced version of it in this answer.

Try the command:

 ps -eo pid,cmd,vsz

This will list process in the format process id, command executed, and virtual memory size of the process in KiB