Select the server and verify fresh data
Confirm the correct server and an online agent. Check report freshness: an old process list does not describe the current machine. UI refresh settings control display rather than agent permissions.
Compare total RAM, used memory and history in Resources. Linux file cache can occupy a substantial share. Host used memory and the sum of process rows need not match.
Sort processes by memory
Open Processes and sort memory descending. Match the names and PIDs at the top to expected workloads. A short process name alone does not establish its purpose.
Check CPU alongside memory. High CPU and RAM can be normal during a heavy job. A low-CPU process can also retain significant memory, such as database buffers.
Observe growth rather than one sample
Compare several updates under similar workload. Memory that keeps growing without stabilizing warrants investigation, but one snapshot cannot establish a leak.
PIDs change after restarts and can be reused by the OS. Compare the process name, server and observation time. For incomplete lists, check agent permissions and OS limitations.
Inspect Docker workloads separately
Open the Docker module for the same node and compare container memory. Memory total covers running containers rather than all host RAM, excluding Linux file cache.
Network counters and recent container logs can help correlate activity with memory growth. The module reads only 50 recent lines from the selected container; use the application’s own log storage for its full history.
Confirm both the cause and the outcome
Review the application’s logs and configuration: limits, buffers, concurrency and workload. Do not terminate an unfamiliar system process just because it tops the table.
After a configuration change, observe a comparable workload again. Check process and host memory, application availability and new events. That is stronger evidence than one smaller number after restarting.
These instructions are based on the release documentation linked below. Commands containing example.com or SERVER_ID are templates: substitute values from your own dashboard. Check the matching release documentation when upgrading.