Recently one machine was swapping. No free space on the swap partition. Hmmm... Since this machine was used as a database server, obviously I suspected mysql. But why to guess when I could knew for sure which process was swapping...

for file in /proc/*/status ; do awk '/VmSwap|Name/{printf $2 " " $3}END{ print ""}' $file; done | sort -k 2 -n -r | less

Wasn't mysql but collectd btw :)