My machine keeps starting processes with command "java" (listed under "command" column in top), that proceed to eat up all my resources for a few seconds, then disapear, a few seconds later a new one will start, with a different PID.

I want to know what is starting these java processes.

I got some information from doing top -> c which shows the java process full command:

11470 neil 20 0 4616088 2.134g 19156 S 121.9 57.1 0:04.20 /opt/jdk-11.0.1/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFr+

However, this does not mean anything to me. Don't know if it helps.

Other answers and things I have already tried:

I have seen this answer How can I find the origin of a process and stop it permanently? which mentions finding the proc/PID directory. Several other similar questions give this advice. But this doesn't help me since the PID keeps changing.

I have tried ps aux | grep java but this only shows grep itself:

neil~$ ps aux | grep java
neil      8539  0.0  0.0  14224   928 pts/19   S+   22:20   0:00 grep --color=auto java

I have tried killall java

And this does kill the current PID but then in a few seconds the next one starts...

I originally thought that this was due to me installing Cisco AnyConnect (see Help uninstalling 3rd party software). The reasons why I assumed this are that a) The problem started when I installed AnyConnect and b) When I was able to kill a java process before it disappeared, the only affected program I could see was AnyConnect, which stopped rendering most of the UI. Now I am not sure, because I uninstalled AnyConnect and the problem remains.

  • 1
    You could simply uninstall Java, then see what breaks. One of the broken is your culprit. Java is not essential to the function of your Ubuntu system - you installed it for your own purposes. – user535733 May 10 '19 at 20:44
  • I could have done this I suppose :) Found the culprit in the end though. – Neil May 13 '19 at 11:32

Command ps auxf from console will give you simple "tree" view of processes. Just kill parent.

Or in your case you should better find process before java: with ps auxf | grep java -B11

  • Thank you so much. It took a few attempts to nail it, but I got eventually. The offending process was... Elasticsearch, running inside a Docker container that I had spun up a week ago and though I had killed but apparently it lived on. – Neil May 13 '19 at 11:30

You can try using the pstree -p command to get ancestor information about the java processes you're trying to track down. This will dump an ASCII depiction of the process tree starting at init, as well as the PIDs for those processes, and may give you information on the parent process that keeps starting java.

  • Thank you for this, it was helpful. Ultimately TadejP's answer took me to the offending process. – Neil May 13 '19 at 11:31

I'd suggest seeing if the pspy utility (from https://github.com/DominicBreuker/pspy) would provide more information about the short-lived processes and the files they attempt to access. If it does, that might allow you to determine what's creating them.


The Java command is truncated bytop. You can try

ps auf | grep java 

To list all have related processes. The full command might give you some insights. BTW, the command sets max heap size of 1Gb, so it should not at least take all your memory, unless it spawns many processes

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.