Linux Real-Time Process Monitor (Top) Explained

Is your Linux system running slow? Want to know what processes are hogging cpu time and/or memory in realtime? Are you just plain curious about how the Linux kernel schedules tasks behind the scenes? Then you need “top,” which is a real-time process monitor command that helps monitor the running processes in a Linux system straight from the command line. “Top” displays system summary information and a list of all processes and threads currently being managed by the Linux kernel. It is also an interactive program, meaning that the output can be customized and manipulated while it’s running.

The default way to run “top” is by typing the command with no options. The default options are usually sufficient for normal everyday use.


The output from top.

The output from top can be separated into two parts: the system summary and the process list.

Related: Three System Monitoring Tools to Supplement top

The system summary is further split into three parts.

1. System Uptime and Load Averages: This is a single line that contains the program name (top), the current time, length of time since last boot, total number of users and the system load average over the last one, five and fifteen minutes.

System Uptime and Load Averages

2. TASK and CPU States: This consists of a minimum of two lines. The first line shows the total tasks or threads (depends on the state of the Threads-mode toggle). This is then further classified into either running, sleeping, stopped or zombie (zombie processes are processes that have been terminated or are finished executing but have not been properly disposed). The second line shows CPU state percentages since the last refresh. The state percentages refer to:

  • us, user : time spent running user processes that haven’t had their priority changed with the ‘nice’ command
  • sy, system : time spent running kernel processes
  • ni, nice : time spent running user processes that have been ‘niced’
  • wa, IO-wait : time waiting for I/O completion
  • hi : time spent on hardware interrupts
  • si : time spent on software interrupts
  • st : time taken from this virtual machine by the hypervisor (if your system isn’t a virtual machine, don’t worry)

TASK and CPU States

3. Memory Usage: This consists of two lines which show the memory use in kibibytes(KiB). Recall that 1 KiB = 1024 bytes, and 1 MiB = 1024 KiB, and so on (in contrast to 1 KB = 1000 bytes, and 1 MB = 1000 KB). Line 1 shows physical memory while line 2 shows virtual memory (swap).

Memory Usage

The processes/tasks/threads being managed by the system is then shown as a list. Each row refers to a single task, while the columns contain task data. The columns can be reordered and edited. The default columns, with descriptions, include:

  • PID – Process ID
  • USER – Name of the effective user (owner) of the process
  • PR – Priority
  • NI – Nice value
  • VIRT – virtual memory size
  • RES – resident memory size
  • SHR – shared memory size
  • S – process status (which could be one of the following: D (uninteruptible sleep), R (running), S (sleeping), T (traced or stopped) or Z (zombie)
  • %CPU – the share of cpu time used by the process since last update
  • %MEM – share of physical memory used
  • TIME+ – total cpu time used by the task in hundredths of a second
  • COMMAND – command name or command line (name + options)

Top is an interactive program. While top is running, you can press ‘h’ or ‘?’ to access a help screen.

Access the help screen.

To show only tasks belonging to a particular user, press ‘u’ or ‘U’ and type the user name.

Show only tasks belonging to a particular user.

To kill a process, type ‘k’ and enter the process id. You must have the required privileges.

To kill a process, type 'k.'

To change the sort order of the list, press ‘f.’ This shows the Fields Management screen. Then select the desired column with the up/down arrow and press ‘s.’ The highlighted part of the image below will change to the selected column. Pressing ‘q’ would return to the main screen, sorted by this column.

The Fields Management screen.

To quit top, simply type ‘q.’ The man pages for top are quite large but definitely worth the read.

man top

For quick assistance while running top (this is worth repeating) press ‘h’ or ‘?’ to get the help screen. There are so many customizations available and so many ways to structure the output to individual preferences. (Hint: Press ‘s’ or ‘d’ and change the refresh rate to 0.9 or less and get a better feel for how Linux process scheduling works. Bonus points for running top as a batch process and piping the output to a file for later study).