Malwarebytes - Cybersecurity for Everyone

Linux pmap Command Cheat Sheet: 40 Examples for Memory Analysis

byShubham Chaudhary •October 26, 2026

0

Linux terminal showing pmap -x output with a process memory map, heap, stack, and shared library mappings for SOC analysis

Linux pmap Command Cheat Sheet: 40 Examples for Memory Analysis and Incident Response

Last verified: October 26, 2026. Flags and output formats vary across procps-ng versions, so confirm against man pmap on your own system.

Picture a 2 a.m. alert (an illustrative scenario, not a specific incident). An endpoint detection and response (EDR) tool flags a process named nginx on a production Linux server, but the binary on disk is clean and the hash matches the vendor package. The analyst on shift needs to know what that process is actually holding in memory, and fast. This is where a small, old utility called pmap earns its place in a Linux incident response toolkit.

What pmap Actually Shows

pmap is part of the procps-ng package. It reports the virtual memory mappings of one or more processes: which libraries are loaded, where the heap and stack sit, and which regions are anonymous (not backed by a file). It reads the same kernel data exposed under /proc/PID/, but formats it so a human can scan it quickly.

For a defender, the value is context. A process list tells you what is running. A memory map tells you what that process has loaded and with which permissions. That difference matters when the on-disk file looks fine but the running process does not behave that way.

Key pmap Flags at a Glance

Flag	What it does
`pmap PID`	Shows the process's virtual memory mappings
`-x`	Extended output: size, resident memory, and dirty pages
`-d`	Adds device information
`-A low,high`	Limits output to an address range on supported procps-ng versions (it does not mean hexadecimal-only output)
`-XX`	Extra-detailed output on versions that support it
`-q`	Quiet output where supported

How to Read pmap -x Output

Run pmap -x PID and you get columns for address, size in KB, resident memory (RSS), dirty pages, permission mode, and the mapping name. Two ideas matter most:

VSZ vs. RSS. VSZ is the virtual memory the process has reserved. RSS is the portion currently resident in physical RAM. Neither equals the process's exact private memory use, because shared libraries are counted in both.
Mode and mapping name. Executable code normally maps to a file such as a binary or a .so library. Writable data lives in heap, stack, or anonymous regions. A mapping that is both writable and executable, or executable but anonymous, deserves a second look.

The 40-Command pmap Cheat Sheet

Replace the example PID 1234 with a real process ID. These commands are read-only and non-destructive, but run them only on systems you are authorized to inspect.

Basic Memory Map Views

# 1. Display the memory map of a process
pmap 1234

# 2. Display extended memory mapping information
pmap -x 1234

# 3. Display memory mappings with device information
pmap -d 1234

# 4. Display mappings restricted to an address range
pmap -A 0x400000,0x500000 1234

# 5. Display detailed memory information for multiple PIDs
pmap -x 1234 5678

# 16. Display memory mappings with full extended details
pmap -XX 1234

# 17. Quiet output where supported
pmap -q 1234

Start with pmap -x. It is the best balance of detail and readability. Use -XX only when you need the extra kernel-provided fields, and expect very wide output.

Finding the Right PID

# 6. Display mappings for the current shell
pmap $$

# 7. Get the current shell PID
echo $$

# 8. Find a process PID by command name
pgrep -x nginx

# 9. Inspect a process's memory map
pmap "$(pgrep -n -x nginx)"

# 10. Display extended mappings and total memory
pmap -x 1234

# 25. Inspect memory mappings for a running service
pmap -x "$(pgrep -o -x nginx)"

# 26. Display memory information for a Python process
pmap -x "$(pgrep -n -x python3)"

# 27. Display memory information for a Java process
pmap -x "$(pgrep -n -x java)"

# 38. Check your own process's memory mappings
pmap -x $$

# 40. Display the process tree to pick individual PIDs
ps -eo pid,ppid,comm --forest

pgrep -n returns the newest matching process and -o the oldest. On a server with many workers, that choice changes which process you inspect, so pick deliberately. The process tree in command 40 helps you map a suspicious child back to its parent.

Summaries and Quick Comparisons

# 11. Display the summary line of a process's memory map
pmap 1234 | tail -n 1

# 15. Show the process's virtual memory size and resident memory
ps -p 1234 -o pid,vsz,rss,comm

# 28. Compare process memory summary with system process information
ps -p 1234 -o pid,vsz,rss,%mem,comm
pmap -x 1234

# 34. Inspect a process's memory-related status fields
grep -E '^(VmPeak|VmSize|VmRSS|VmData|VmStk|VmExe|VmLib|VmSwap):' /proc/1234/status

The last line of pmap output is a total. Comparing it with ps and /proc/PID/status is a quick sanity check, and a sudden jump between two snapshots can hint at a leak or unusual allocation activity.

Filtering for Specific Regions

# 21. Search for shared library mappings
pmap 1234 | grep '\.so'

# 22. Search for anonymous memory mappings
pmap 1234 | grep '\[ anon \]'

# 23. Search for stack mappings
pmap 1234 | grep '\[ stack \]'

# 24. Search for heap mappings
pmap 1234 | grep '\[ heap \]'

Labels differ between versions. On some systems the heap appears as [ anon ] rather than [ heap ], so an empty result from command 24 does not mean the heap is missing.

Procfs: The Lower-Level Source

# 12. Show mapping sizes and permissions from procfs
cat /proc/1234/maps

# 13. Display detailed memory statistics from procfs
cat /proc/1234/smaps

# 14. Display the overall memory summary for a process
grep -E '^(Rss|Pss|Private|Shared|Swap|Anonymous):' /proc/1234/smaps_rollup

# 35. Inspect mapped files and memory permissions
less /proc/1234/maps

# 36. Inspect detailed per-mapping memory statistics
less /proc/1234/smaps

# 37. Inspect the process's memory map using its PID
cat /proc/1234/maps

Command 14 is underrated. smaps_rollup gives proportional set size (PSS), which divides shared pages fairly among the processes using them, so it is a more honest number than RSS.

Safe Handling and Reporting

# 18. Check whether a process exists before inspecting it
ps -p 1234 -o pid,stat,comm

# 19. Inspect a process's memory map and save the output
pmap -x 1234 > pmap-report.txt

# 20. Append memory map output to an existing report
pmap -x 1234 >> pmap-report.txt

# 39. Save extended memory details for incident investigation
pmap -x 1234 > "pmap-1234.txt"

Careful with the redirects: a single > overwrites an existing file. For investigations, use a timestamped filename so you never clobber earlier evidence, and save snapshots at intervals if the behavior is changing.

Help and Version Checks

# 29. Display the pmap manual
man pmap

# 30. Display supported pmap options
pmap --help

# 31. Check the installed pmap version, if supported
pmap --version

# 32. Check the procps package version on Debian/Ubuntu
dpkg -s procps | grep Version

# 33. Check the procps-ng package version on Fedora/RHEL
rpm -q procps-ng

Check the version before you copy a command into a runbook. A flag that works on one distribution may be absent or behave differently on another.

Using pmap for Linux Threat Hunting

pmap does not detect malware by itself. What it does is give you a fast, low-impact way to form a hypothesis. Here is how a SOC analyst might use it, based on common triage practice:

Unexpected libraries. A web server loading a library from /tmp or a user's home directory, instead of from system paths, is worth escalating.
Executable anonymous memory. Legitimate runtimes such as JIT compilers (Java, some Python builds) create executable anonymous regions, so this is a lead, not a verdict. A simple service with no JIT that shows one is more interesting.
Deleted backing files. A mapping whose file is marked as deleted can mean the binary was removed after launch. It can also be a harmless package update that replaced a library under a running service, so check the package manager logs.
Size anomalies. Compare a process against a known-good peer on a similar host. A worker with a heap many times larger than its siblings is a reason to investigate.

When a map looks suspicious, the next step is not more pmap. Preserve evidence, record the process tree, and hand off to your memory acquisition and forensics process. Enterprise teams often feed these checks into their EDR and incident response playbooks so the triage steps are repeatable.

Cross-Checking with /proc

pmap is a convenient view, but the kernel data in /proc/PID/maps and smaps is the source of truth. Reading it directly helps when pmap is missing, trimmed in a minimal container, or behaving differently across versions. Access may be restricted by system security settings: ordinary users can often inspect only their own processes, and hardening options such as hidepid or ptrace restrictions can limit what even a privileged shell sees. If a read fails with a permission error, document it rather than working around controls you were not authorized to change.

Common Pitfalls

The process exits first. A short-lived process can vanish before pmap reads it. Check with ps -p and handle the error in scripts.
Misreading VSZ. Large virtual size alone is rarely a problem. Many healthy runtimes reserve far more address space than they use.
Treating one snapshot as the story. Memory changes constantly. Capture more than one sample when you can.
Sensitive paths in reports. Saved output can expose internal file paths and service layouts. Store it with the same care as other incident artifacts.

Expert Tips

Build a baseline map for your critical services on a clean host, then diff against it during incidents.
Pair pmap -x output with the process tree and network connections before drawing conclusions.
Prefer PSS from smaps_rollup when reporting real memory cost on shared-library-heavy hosts.
Note the pmap and procps-ng version in your case notes so another analyst can reproduce your output.

Capcom Data Breach: 11.77M Records Exposed – Are You Safe?
VeloCloud Orchestrator Flaw: Read-Only Login Gives Superuser
55 Linux Job Control Commands Every SOC Analyst Should Know
PHP2Shell Patch Guide: Fix CVE-2026-109618 & 109619 Fast
FortiSIEM CVE-2026-106173: Public PoC Drops, Patch Now
Linux renice Command: 54 Examples to Control CPU Priority
SBI Data Breach Claim: What's Real and What's Not
Linux nice Command: 30 Examples to Protect Your Server CPU

FAQ

What does the pmap command do in Linux?

It displays the virtual memory mappings of a process, including loaded libraries, heap, stack, and anonymous regions.

What is the difference between pmap -x and pmap -d?

The -x flag adds extended details such as size, resident memory, and dirty pages. The -d flag adds device information.

Is VSZ the same as actual memory use?

No. VSZ is reserved virtual size and RSS is resident physical memory. Neither is the exact private memory a process consumes.

Can pmap detect malware?

Not on its own. It helps you spot unusual mappings that justify deeper investigation with EDR, logs, and forensic tooling.

Why does pmap say the process does not exist?

The process may have exited between listing and inspection. Verify the PID with ps -p first.

Why does my output differ from a tutorial?

Available flags and output formats vary across procps-ng versions and distributions. Check man pmap on your system.

Conclusion

pmap is not flashy, but it answers a question every responder eventually asks: what is this process really holding in memory? Learn pmap -x, understand VSZ versus RSS, cross-check with /proc, and keep your claims cautious. A suspicious mapping is a lead worth following, not a conviction. Used that way, a few seconds of pmap can save an analyst a lot of guesswork during triage.

Analysis based on SOC monitoring experience and review of public Linux documentation.