Linux: Monitor Processes, “top” Tutorial

Xah Lee, 2012-10-11

In terminal, type top. Then, try the following in order:

1. 【z】 ⇒ toggle color.
2. 【x】 ⇒ toggle coloring of sort column.
3. 【s 9 9 Enter ↵】 ⇒ set update frequency to every 99 seconds.
4. 【Space】 ⇒ force a update.
5. 【>】 ⇒ change the sort column to the right of current sort column.
6. 【<】 ⇒ change the sort column to the left.
7. 【R】 ⇒ toggel reverse sort order.
8. 【O k Enter ↵】 ⇒ order by CPU usage. (also 【P】)
9. 【O n Enter ↵】 ⇒ order by memory usage. (also 【M】)
10. 【O a Enter ↵】 ⇒ order by pid.
11. 【O x Enter ↵】 ⇒ order by process name.
12. 【c】 ⇒ show full path of commands.
13. 【k】 ⇒ kill a process by pid.
14. 【u ‹user›】 ⇒ show only processes of a user.
15. 【h】 ⇒ help.
16. 【q】 ⇒ quit.

top - 12:59:21 up 20:59,  0 users,  load average: 1.05, 0.93, 0.90
Tasks: 139 total,   1 running, 137 sleeping,   0 stopped,   1 zombie
Cpu(s):  5.4%us, 32.4%sy,  0.0%ni, 62.2%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:    800340k total,   652680k used,   147660k free,    45688k buffers
Swap:   818172k total,     8584k used,   809588k free,   315372k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
 1179 root      20   0 80464  36m  10m S 10.8  4.6  35:54.21 Xorg
 4631 xah       20   0  2844 1132  844 R  8.1  0.1   0:00.22 top
 1905 xah       20   0  181m  13m 9924 S  5.4  1.7  50:24.25 xfce4-systemloa
 1877 xah       20   0  5256 2240 1632 S  2.7  0.3   0:50.90 xscreensaver
 1892 xah       20   0  210m  20m  13m S  2.7  2.6   1:37.57 xfce4-panel
 1899 xah       20   0  184m  17m  12m S  2.7  2.2   0:31.26 xfdesktop
 1964 xah       20   0  219m  19m  13m S  2.7  2.5   1:13.15 xfce4-terminal
    1 root      20   0  3328 1592 1144 S  0.0  0.2   0:01.73 init
    2 root      20   0     0    0    0 S  0.0  0.0   0:00.06 kthreadd
    3 root      20   0     0    0    0 S  0.0  0.0   2:27.87 ksoftirqd/0
    5 root      20   0     0    0    0 S  0.0  0.0   0:00.38 kworker/u:0
    6 root      RT   0     0    0    0 S  0.0  0.0   0:00.00 migration/0
    7 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 cpuset
    8 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 khelper
    9 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 netns
   10 root      20   0     0    0    0 S  0.0  0.0   0:02.10 sync_supers
   11 root      20   0     0    0    0 S  0.0  0.0   0:00.07 bdi-default
   12 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 kintegrityd
   13 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 kblockd
   14 root       0 -20     0    0    0 S  0.0  0.0   0:00.02 ata_sff
   15 root      20   0     0    0    0 S  0.0  0.0   0:00.10 khubd
   16 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 md
   19 root      20   0     0    0    0 S  0.0  0.0   0:00.18 khungtaskd
   20 root      20   0     0    0    0 S  0.0  0.0   0:05.66 kswapd0
   21 root      25   5     0    0    0 S  0.0  0.0   0:00.00 ksmd
   22 root      39  19     0    0    0 S  0.0  0.0   0:00.00 khugepaged
   23 root      20   0     0    0    0 S  0.0  0.0   0:00.00 fsnotify_mark

Summery Area

top - 12:59:21 up 20:59,  0 users,  load average: 1.05, 0.93, 0.90
      current     system                     past 1 min, 5 min, 15 min
      time        uptime

Divide load average by number of CPU × number of CPU core to get a sense of CPU load. If the result is 1, then it means 100% CPU use. Higher than 1 means overloaded.

Tasks: 139 total,   1 running, 137 sleeping,   0 stopped,   1 zombie

Cpu(s):  5.4%us, 32.4%sy,  0.0%ni, 62.2%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
          user    system    niced     idle   IO wait

• us = User CPU time ⇒ The time the CPU has spent running users' processes that are not niced.
• sy = System CPU time ⇒ The time the CPU has spent running the kernel and its processes.
• ni = Nice CPU time ⇒ The time the CPU has spent running users' proccess that have been niced. (see: man nice)
• wa = iowait ⇒ Amount of time the CPU has been waiting for I/O to complete.
• hi = Hardware IRQ ⇒ The amount of time the CPU has been servicing hardware interrupts.
• si = Software Interrupts ⇒ The amount of time the CPU has been servicing software interrupts.
• st = Steal Time ⇒ The amount of CPU “stolen” from this virtual machine by the hypervisor for other tasks (such as running another virtual machine).

Mem:    800340k total,   652680k used,   147660k free,    45688k buffers
Swap:   818172k total,     8584k used,   809588k free,   315372k cached

Actual free memory (RAM) available to programs is: free + buffers + cached. For detail, see: Linux: How Much Memory is Really Free?.

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND

• PID = Process Id
• USER = User Name
• PR = Priority
• NI = Nice value
• VIRT = Virtual Image (kb)
• RES = Resident size (kb)
• SHR = Shared Mem size (kb)
• S = Process Status
• %CPU = CPU usage
• %MEM = Memory usage (RES)
• COMMAND = Command name/line
• TIME+ = CPU Time, hundredths

For some explanation of these, do man top.

Common Top Options

• top -d 9 run top with delay (update frequency) set to 9 seconds.
• top -u john show only processes from user john.
• top -n 10 run top with 10 updates, then exit.
• top -b -n 1 > top_out.txt. Dump top output as plain text to a file. The “-b” means batch mode. Basically, in batch mode, it dosn't accept any interactive inputs. If you run top -b, use 【Ctrl+c】 to exit.

A Better top: htop

unix “top” is a very old program. It has some problems. For example, sometimes you want to view one particular process, but if you don't have a long screen, it's very diffucult or impossible, unless you find the pid first than call top -p ‹pid›.

A much better one is “htop”. See Linux: Monitor Processes, “htop” Tutorial.