When examining process memory usage with pmap, the output contains several critical columns that reveal different aspects of memory allocation. Let's break down the example:

Address           Kbytes     RSS   Dirty Mode   Mapping
00000000006b4000      60      16      16 rw---    [ anon ]

Kbytes: This shows the total virtual memory allocated to this memory segment (60KB in our example). This represents the address space reserved by the process.

RSS (Resident Set Size): The portion of memory actually residing in physical RAM (16KB here). This is what's actively consuming physical memory resources.

Dirty: The amount of memory that has been modified and needs to be written back to disk if the page gets evicted (16KB in this case). Dirty pages are those that have been written to since they were loaded from disk or created.

When you see RSS matching Dirty size (as in our example), it indicates:

• The entire resident memory has been modified
• These are likely heap allocations or dynamic memory that's been written to
• The process would need to preserve this data if swapped out

Here's a C program that demonstrates how these metrics change with different memory operations:

#include 
#include 
#include 

#define ALLOC_SIZE (60 * 1024)  // Matches our pmap example

int main() {
    // Allocate memory matching our pmap example
    char *buffer = malloc(ALLOC_SIZE);
    
    // Initial state: allocated but untouched
    printf("Allocated %d bytes. Check pmap now\n", ALLOC_SIZE);
    getchar();
    
    // Touch every page to make it resident
    memset(buffer, 0, ALLOC_SIZE);
    printf("Memory touched. Check pmap again\n");
    getchar();
    
    // Modify portion of memory
    strcpy(buffer, "Creating dirty pages");
    printf("Memory modified. Final pmap check\n");
    getchar();
    
    free(buffer);
    return 0;
}

When monitoring processes with pmap, watch for these patterns:

# Monitoring memory changes over time
watch -n 1 'pmap -x $(pidof your_process) | grep anon'

Common scenarios to watch for:

• High RSS but low Dirty: Memory is being read but not modified
• RSS much smaller than Kbytes: Memory is allocated but not actively used
• Dirty close to RSS: Process is actively modifying its memory space

Understanding these metrics helps with:

• Memory leak detection (growing RSS/Dirty over time)
• Swap usage analysis (high Dirty may indicate swap pressure)
• Performance tuning (reducing unnecessary dirty pages)

When analyzing process memory usage with pmap, you'll encounter three key metrics for each memory segment:

Address           Kbytes     RSS   Dirty Mode   Mapping
00000000006b4000      60      16      16 rw---    [ anon ]

Kbytes: Total virtual memory allocated to the segment (60KB in this case)

RSS (Resident Set Size): Physical memory actually being used (16KB)

Dirty: Modified pages that must be written to disk before being reused (16KB)

Let's create a simple C program to demonstrate how these values change:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main() {
    // Allocate 60KB memory
    char *mem = malloc(60 * 1024);
    
    // Write to first 16KB
    memset(mem, 'A', 16 * 1024);
    
    printf("Memory allocated and partially used. Check pmap output now.\n");
    getchar();
    
    free(mem);
    return 0;
}

After running this program and checking with pmap -x [pid], you might see:

Address           Kbytes     RSS   Dirty Mode   Mapping
00007f3d4a2b5000      60      16      16 rw---    [ heap ]

Dirty pages impact system performance because:

• They require disk I/O when swapped out
• They affect memory pressure calculations
• They can't be shared between processes

Combine pmap with other tools for deeper analysis:

# Show detailed memory info
pmap -XX [pid]

# Monitor changes over time
watch -n 1 "pmap -x [pid] | grep heap"

# Compare before/after memory operations
pmap -x [pid] > before.txt
# ... perform operation ...
pmap -x [pid] > after.txt
diff before.txt after.txt