How to Check RAM Usage on Mac in Terminal (What's Using It)

To see what is using your RAM on a Mac from Terminal, list the top processes by memory:

top -l 1 -o mem -n 5 -stats pid,command,mem

For a one-line health check, run memory_pressure and read its last line, System-wide memory free percentage. Below is real output from my 16 GB MacBook Air, plus how to read swap and compressed memory, and why ps can disagree with top by gigabytes.

Step 1: Which apps use the most memory (top)

top -l 1 -o mem -n 8 -stats pid,command,mem

-l 1 takes one sample and exits. -o mem sorts by memory. -n 8 shows eight processes. -stats picks the columns.

Processes: 645 total, 3 running, 642 sleeping, 4104 threads
PhysMem: 15G used (2906M wired, 6980M compressor), 123M unused.
VM: 324T vsize, 6144M framework vsize, 217386(0) swapins, 749917(0) swapouts.

PID    COMMAND          MEM
2045   vendor-agentd    6995M
752    vendor-agentd    6983M
2587   Google Chrome He 2161M
87039  Notion Helper (R 1011M
51389  Claude Helper (R 1008M
548    mds              686M
601    WindowServer     558M
992    fileproviderd    532M

(I trimmed some header lines and renamed one process to vendor-agentd — it is not Apple’s own SecurityAgent.) The two top entries were a third-party background security agent. Each copy claimed about 7 GB. That one finding explained why my Mac felt slow.

The PhysMem line is the quick summary: 15 GB used, 2.9 GB wired (locked by the system), 6.9 GB used by the compressor, and only 123 MB unused. Low “unused” is normal on macOS. Free RAM is wasted RAM, so the system fills it with cache.

Step 2: Is memory actually a problem? (memory_pressure)

memory_pressure | tail -1

System-wide memory free percentage: 38%

You can ask the kernel for the pressure level directly:

sysctl kern.memorystatus_vm_pressure_level

kern.memorystatus_vm_pressure_level: 2

1 is normal, 2 is warning, 4 is critical. These match the colors in Activity Monitor’s Memory tab:

Activity Monitor graph	Meaning	What to do
Green	Normal. RAM is used efficiently.	Nothing.
Yellow	Warning. macOS is compressing and may swap.	Quit apps you do not need.
Red	Critical. Heavy swapping.	Quit the biggest app, or add RAM next time.

Gotcha: “38% free” and a warning at the same time

My Mac reported 38% free and pressure level 2. They measure different things. The percentage counts memory the system could reclaim, including inactive and cached pages. The level reflects how hard macOS is working to find room. Trust the level, or the graph color, more than the percentage.

Gotcha: do not pass arguments to memory_pressure

Run memory_pressure with no options. Its help text says it will “Allocate memory and wait forever” when given a page count, and -l or -p make it eat RAM until a warning fires. It is a stress-test tool that happens to print stats. I only ran the bare command.

Step 3: The raw numbers (vm_stat)

vm_stat

Mach Virtual Memory Statistics: (page size of 16384 bytes)
Pages free:                                     3660.
Pages active:                                 191299.
Pages inactive:                               187603.
Pages speculative:                              3232.
Pages wired down:                             182795.
Pages stored in compressor:                  2090342.
Pages occupied by compressor:                 441331.
Swapins:                                      217382.
Swapouts:                                     749917.

(Shortened.) The numbers are pages, not bytes. The page size is in the first line:

Apple Silicon Macs: 16384 bytes (16 KB)
Intel Macs: 4096 bytes (4 KB)

To convert to GB: pages × page size ÷ 1,073,741,824. This one-liner does it and reads the page size for you, so it works on both:

vm_stat | awk -v ps=$(pagesize) '/^Pages (free|active|inactive|speculative|wired down|stored in compressor|occupied by compressor):/ {n=$NF; sub(/\./,"",n); sub(/:.*/,""); printf "%-30s %6.2f GB\n", $0, n*ps/1073741824}'

Pages free                       0.10 GB
Pages active                     2.88 GB
Pages inactive                   2.86 GB
Pages speculative                0.04 GB
Pages wired down                 2.79 GB
Pages stored in compressor      31.92 GB
Pages occupied by compressor     6.75 GB

If you use a guide written for Intel and multiply by 4096 on an M-series Mac, your numbers will be four times too small.

Compressed memory and swap

Look at the last two lines above. The compressor was holding 31.9 GB of data in 6.75 GB of real RAM, close to 5:1. That is how a 16 GB Mac keeps running with more open than fits. Compression is cheap. Swap is the slower fallback, where pages go to the SSD.

sysctl vm.swapusage

vm.swapusage: total = 9216.00M  used = 8268.88M  free = 947.12M  (encrypted)

8.3 GB of swap in use. This Mac had been up for 58 days, so swap had built up over time. A restart clears it. Swap size grows on its own as needed, so a big number is not an error. It is a sign that something, here the security agent, held a lot of memory.

Gotcha: ps and top disagree by gigabytes

The classic command for memory per process is ps:

ps -A -c -m -o pid,%mem,rss,comm | head -7

  PID %MEM    RSS COMM
51389  4.8 807328 Claude Helper (Renderer)
82771  2.0 337920 claude
 1658  1.4 239456 Google Chrome
94099  1.4 228160 claude
51349  1.3 220256 Claude
87039  1.3 212368 Notion Helper (Renderer)

(RSS is in KB. -m sorts by memory. -c shows short names instead of full paths.)

The 7 GB security agent is not in this list at all. Checking it directly:

ps -o pid,%mem,rss,comm -p 2045
footprint 2045

  PID %MEM    RSS COMM
 2045  0.1  11040 SecurityAgent

vendor-agentd [2045]: 64-bit (translated)    Footprint: 6994 MB (4096 bytes per page)

(Output shortened; process name and path replaced.) ps said 11 MB. footprint said 6,994 MB. The difference: RSS only counts pages sitting in RAM right now. Almost all of this process’s memory had been compressed or swapped out, so RSS missed it. top’s MEM column and Activity Monitor’s Memory column count it, which is why they are the better guide. If a process looks small in ps but large elsewhere, believe the larger number.

Side note: “translated” means the app runs under Rosetta as an Intel binary, and it uses 4 KB pages even on Apple Silicon.

What to do with a memory hog

Quit it normally from its menu or the Dock first.
In Activity Monitor, select it, click the (x) button, then choose Quit or Force Quit.
From Terminal, kill <PID> asks it to quit. Only kill processes you know. See how to kill a process on a port on Mac for finding PIDs safely.

I did not quit anything on the test Mac. A security agent like that one is often required by a bank or employer, so the better fix is to update it or ask its vendor.

Common questions

How do I see what is using my RAM on a Mac without Terminal?

Open Activity Monitor (Applications > Utilities), click the Memory tab, and sort by the Memory column. The pressure graph at the bottom shows green, yellow or red.

Is high memory usage bad on a Mac?

No. macOS uses spare RAM for cache. Watch the pressure color and swap, not “used”.

How much RAM does my Mac have?

sysctl hw.memsize

hw.memsize: 17179869184

That is bytes. 17,179,869,184 ÷ 1,073,741,824 = 16 GB.

How do I watch memory live?

Run top -o mem without -l 1. Press q to quit.

Does restarting help?

Yes, if swap is large and a process has grown over days. It clears swap and the compressor. To check whether your Mac sleeps during long jobs instead, see keep your Mac awake with caffeinate.