30 Top Command Examples for Monitoring in Linux

The top command in Linux displays the running processes on the system. One of the most important tools for a system administrator. It is used extensively for monitoring the load on a server. In this article, we explore the top command in detail. The top command is an interactive command. Many commands are available when top is running. We will explore these commands as well.

1. Default Top Command

First of all, let us understand what the output says. Top command displays a lot of information about the running system. But we need to understand the meaning of different sections of this output. To see running process, on terminal run the command below

# top

Running by default, the top command displays output like this:

Top default display

There are some information in differents columns and  horizontals lines showing summary about different system parameters, and following these are the processes and their attributes in columns.

a) Fields/Columns

By default, top shows some attributes associated with processes and the type of information is represented in column. So to understand how the top command functions, we must know the role of each column in order to know where is to information that  we should need

Top columns

PID: The Process ID represented by a unique value which uniquely identifies a process.

USER: The effective user name of the owner of the processes. It helps to exactly identify the processes launched by a particular user

PR: it is the process's actual priority, as viewed by the Linux kernel, the scheduling priority of the process. For normal processes, the kernel priority is simply +20 from the nice value. Thus a process with the neutral nice value of zero has a kernel priority of 20. For processes running under real-time, the value of the field is RT

NI: It is the nice value of the process corresponding to a user-space concept. Nice value range is -20 to +19 where -20 is highest, 0 default and +19 is lowest. Lower values mean higher priority. The relation between nice value and priority is PR = 20 + NI

VIRT: It is the amount of virtual memory used by the process. It represents how much memory the program is able to access at the present moment; it stands for the virtual size of a process, which is the sum of memory it is actually using,

RES: It is the resident memory size. Resident memory is the amount of non-swapped physical memory a task is using. It stands for the resident size, which is an accurate representation of how much actual physical memory a process is consuming. (This also corresponds directly to the %MEM column.) This will virtually always be less than the VIRT size, since most programs depend on the C library.

SHR: SHR is the shared memory used by the process and it indicates how much of the VIRT size is actually sharable (memory or libraries). In the case of libraries, it does not necessarily mean that the entire library is resident.

S: This is the process status. Processes are defined by a functioning state. It can have one of the following values:

  • D - uninterruptible sleep: a sleep state where the process is waiting for something to happen. It cannot be interrupted by a signal; it is usually seen when the process is waiting for the disk.
  • R - running: the process is ready to run, and will run whenever its turn to use the CPU comes
  • S - sleeping: a sleep state where the process is waiting for something to happen. It can be interrupted by a signal
  • T - traced or stopped: it is a state where the process is stopped, usually via SIGSTOP or SIGTSTP. It can also be stopped by a debugger (ptrace). When you see that state, it is usually because you used Ctrl-Z to put a command in the background.
  • Z - zombie: is a state where the process is dead (it has finished its execution), and the only thing left is the structure describing it on the kernel. It is waiting for its parent process to retrieve its exit code, and not much more. After its parent process is finished with it, it will disappear.

%CPU: It is the percentage of CPU time the task has used since last update. The percentage of the CPU that is being used by the process. By default, top displays this as a percentage of a single CPU. On multi-core systems, you can have percentages that are greater than 100%.

%MEM: It represents the percentage of available physical memory used by the process. It can be considered like the share of total available memory used by that process.

TIME+: The total CPU time the task has used since it started, with precision up to hundredth of a second.

COMMAND: The command which was used to start the process.

There are many other outputs which are not displayed by default which can display information about page faults, effective group and group ID of the process, and many more.

b) Uptime and Load Averages

When you are in the "top mode", at the first line of the result of top command, it is displayed an output similar to uptime command.

Uptime display

The fields display the information below:
* the current time of the system
* the time your system is been up
* number of users logged in the system
* load average of 5, 10 and 15 minutes respectively.
This uptime display can be toggled with l key and can hide the load average information.

c) Tasks

Task summary

The second line shows the summary of tasks or processes. The processes can be in different states as we have seen above for the 'S' column. It shows the differents processes and its states

d) CPU States

The third line shows the differents  CPU statitics.

CPU status display

The meaning of different CPU times are:

  • us, user: it shows us that the processor is spending 1.8% of its time running user space processes. A user space program is any process that doesn't belong to the kernel.
  • sy, system: it is the amount of time that the CPU spent running the kernel.
  • ni, niced: shows how much time the CPU spent running user space processes that have been niced. On a system where no processes have been niced then the number will be 0.
  • id, idle: it tells us that the processor was idle just over 97% of the time during the last sampling period.
  • wa, IO wait: it is idle while waiting for an I/O operation to complete
  • hi: how much time the processor has spent servicing hardware interrupts
  • si: how much time the processor has spent servicing software interrupts

This can be toggled with t key which determines how tasks are displayed and can hide the task and cpu information.

e) Memory Usage

This portion consists of two lines which may express values in kibibytes (KiB), mebibytes (MiB) or gibibytes (GiB) depending on the amount of currently installed physical memory.

  • Line 1 reflects physical memory, classified as: total, used, free, buffers
  • Line 2 reflects virtual memory, classified as: total, used, free, cached

Memory usage

  • Physical memory is your RAM, physical pieces of hardware that provide Random Access Memory
  • Swap is virtual memory which can be a file or a partition on your hard drive that is essentially used as extra RAM. It is not a separate RAM chip though, it resides on your hard drive.

The memory can be toggled with m key which determines how memory usage is displayed and can hide the memory information.

2. Display Interactive Help menu

It has a powerful interactive mode that is active by default when Top is started. A variety of commands can be used in the form of just letter key presses to manipulate what is being seen. Here we explore these commands further.

First of all, you can press h or ? to display the help menu for interactive commands or a condensed list of commands. We can see the roles of the differents key that we can use in top command execution.

Help options

3. Manually Refresh Display

The top command by default refreshes the displayed information after a certain interval (3 seconds). To refresh theses information manually, user can press ENTER or SPACE.

4) Toggle Alternate Display Mode

By default, we have the full screen display mode where the summary and the task data are displayed in a single window. So, at any time, only one field group can be displayed. There is also the Alternate Display Mode, where there can be a maximum of four windows, each displaying a field group. These windows are named Def, Job, Mem and Usr

  • Def: sorted by %CPU
  • Job: sorted by PID
  • Mem: sorted by %MEM
  • Usr: sorted by User field

The Alternate Display Mode can be entered into using the A display mode toggle command. Each of the 4 field groups has a unique separately configurable summary area and its own configurable task area. Only one of these 4 windows will be the current window. The current window is displayed on the top left corner.

Alternative display mode

You can switch between 4 windows with a and w keys. a moves to next and w to previous window. With g command, you can enter a number to select the current window.

Window selection in alternative display

5) Bold Display

Some important information is shown in bold characters. B command toggles use of bold. This command will influence the use of the bold terminfo capability and alters both the summary area and task area for the current window. When this toggle is 'ON' and top is operating in monochrome mode, the entire display will appear as normal text. Thus, unless the x and/or y toggles are using reverse for emphasis, there will be no visual confirmation that they are even on.

Bold off

6) Set Display Time interval

d or s keys change the delay between refreshes. Prompt for new delay time, which should be in seconds. Suppressed in secure mode. When d or s is pressed, you will be prompted to enter a value ( in seconds ) which will be set as display interval. If you enter 1 here, top will refresh every second.

Display time interval

7) Toggle Load, Task, Memory Info

l, t and m keys will toggle load average, task/cpu status and mem info respectively as discussed in Uptime and Load Average, CPU State and Memory Usage.

Load average off

CPU summary off

Memory and swap usage off

All three displays off

8) Field Management for display

F key used to choose what field you want to display on the output screen. To select a field to display, press SPACE or d key on the name. The fields marked as * are selected. Press q or ESC to quit when you have finished.

Managing columns

< and >
The < command moves the sorted field to the left and > to the right

9) Reverse Sort

By default, the sorting is done in descending order. Pressing R shall reverse the sorting order of the currently sorted column, using this interactive command displays pProcesses consuming the least amount of cpu are shown first.

10) Show the command path

c displays the full command path along with the command line arguments in the COMMAND column.

Full command path

11) Idle Tasks

i key does not show idle tasks Toggle idle tasks. It displays all tasks or just active tasks. When this toggle is Off, tasks that have not used any CPU since the last update will not be displayed. However, due to the granularity of the %CPU and TIME+  fields,  some process may still be displayed that appear to have used no CPU.

Idle task display off

12) Forest View

V key will display the processes in a parent-child hierarchy as below

Forest view of tasks

13) Change color map

Pressing the Z key takes the user to a screen where the display color can be changed for top command. You will be presented with a separate screen. That screen can be used to change the colors in just the current window or in all four windows before returning to the top display. When you issue the Z interactive command, you have 4 upper case letters to select a target for 8 numbers to select a color

Customizing colors

The below screen shows full colored top view with all 4 screens on.

Colored display

14) Toggle Color

z turns on or off the colored display. it switches the current window between your last used color scheme and the older form of black-on-white or white-on- black. This command will alter both the summary area and task area

15) Change highlight for current sort field and running task

x for Column-Highlight toggle changes highlighting for the current sort field. If you forget which field is being sorted, this command can serve as a quick visual reminder, providing the sort field is being displayed. The sort field might not be visible because there is insufficient Screen Width and/or the f interactive command turned it Off

y for Row-Highlight toggle changes highlighting for running tasks. The Use of this provision provides important insight into your system's health. The only costs will be a  few  additional tty escape sequences

Depending on your display settings, You might have to make the output colored in order to notice these highlights.

X and Y highlighted

16) Show the processes of a User

u shows processes for a particular user. You are prompted to enter the username. Blank will show for all users. It displays only processes with a user id or user name matching that given,  matches on effective user

Processes of 'raghu' user

17) Show the number of tasks displayed

n or # set the maximum number of tasks displayed. It prompts to enter the number of tasks to display. The lessor of your number and available screen rows will be used. When used in alternate-display mode, this is the command that gives you precise control over the size of each currently visible task display, except for the very last. It will not affect the last window's size, as all prior task displays will have already been painted.

Setting number of tasks displayed

18) Kill tasks

One of the most important commands of top. k is used to send signals to tasks (Usually kill tasks). You will be prompted for a PID and then the signal to send. Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself. The default signal, as reflected in the prompt, is SIGTERM. However, you can send any signal, via number or name. If you wish to abort the kill process, do one of the following depending on your progress: at the

  • at the pid prompt, type an invalid number
  • at the signal prompt, type 0 (or any invalid signal)
  • at any prompt, type <Esc>

Killing a task

19) Renice a task

The r option is used to change the priority of the process. This operation is also called renice a task to change the scheduling priority. You will be prompted for a PID and then the value to nice it to. Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself. A positive nice value will cause a process to lose priority. Conversely, a negative nice value will cause a process to be viewed more favorably by the kernel.

As a general rule, ordinary users can only increase the nice value and are prevented from lowering it. If you wish to abort the renice process, do one of the following depending on your progress:

  • at the pid prompt, type an invalid number
  • at the nice prompt, type <Enter> with no input
  • at any prompt, type <Esc>

20) Separate CPU state

This command affects how the t command's Cpu States portion is shown. When you see %Cpu(s) in the summary area, the 1 toggle is On and all cpu information is gathered in a single line. Otherwise, each cpu is displayed separately as: `%Cpu0, %Cpu1, ...' up to available screen height.

21) Summarize CPU state

This 2 command toggles between the 1 command cpu summary display (only) or a summary display plus the cpu usage statistics for each NUMA Node.

22) Display top command in batch mode

The -b option starts top command in batch mode. It can be useful when you want to save the output in a file.

# top -b
top - 01:05:36 up 4 days,  2:59,  1 user,  load average: 0.00, 0.00, 0.00
Tasks: 117 total,   1 running, 116 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.6 us,  0.2 sy,  0.0 ni, 99.1 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem :   500096 total,    50244 free,    45732 used,   404120 buff/cache
KiB Swap:        0 total,        0 free,        0 used.   414836 avail Mem 

 1373 root      20   0   40388   3672   3160 R  6.2  0.7   0:00.02 top
    1 root      20   0   38052   5600   3488 S  0.0  1.1   0:23.26 systemd
    2 root      20   0       0      0      0 S  0.0  0.0   0:00.01 kthreadd
    3 root      20   0       0      0      0 S  0.0  0.0   0:09.17 ksoftirqd/0
    7 root      20   0       0      0      0 S  0.0  0.0   0:27.64 rcu_sched
    8 root      20   0       0      0      0 S  0.0  0.0   0:00.00 rcu_bh
    9 root      rt   0       0      0      0 S  0.0  0.0   0:00.00 migration/0
   10 root      rt   0       0      0      0 S  0.0  0.0   0:04.02 watchdog/0

23) Command/Program-name toggle

As discussed in the above commands, the -c option will toggle from the last remembered state of command/program name display.

24) Set delay interval in command line

-d sets the delay interval for top (in seconds). For example:

$ top -d 1

will start the top command with 1 sec delay interval.

25) idle process toggle in command line


$ top -i

26) Set number of iterations in command line

With -n option, you can set the number of iterations after which top will end.

$ top -n 3

will exit top automatically after 3 outputs. In the image below, it exited automatically

27) Monitor specific PIDs in command line

You can specify what PIDs you want to monitor with -p option. PID value 0 will be treated as process ID of top command itself.

$ top -p pid_value

28) Display task per username or UID in command line

The process of a particular user can be viewed with these options. Username or UID can be specified to the option. The -p, -u and -U options are mutually exclusive. Only one of the options can be used at a time. You get an error when you try to use any combination of these options:

$ top -u franshesco

29) Make a sort by ... in command line

The -o can be used with top command for filtering. It determines which tasks will be shown in the `current' window. For example, we will sort by %CPU

# top -o %CPU

30) Check top command version

To check the top command version, we use -v option

# top -v
  procps-ng version 3.3.10


Now we can manipulate our processes by top command. We have its powerful and advantages. It is possible to use it in command-line or in interactive mode. Now, we can easily choose how to use it for our needs.

7 Comments... add one

  1. Hi,
    Great article. I learnt a lot from this.
    I have a question though. Can we show particular columns in Linux from command line, the way we show them in mac using -stats pid, res, ...


    • Hey Shafoo,

      Two option you have (output from centos)

      1)pass values using awk


      top -b -n 1 | awk '{print $1,$2,$NF}'

      2) press "f" and it will list all avalable column names. You can deselect the columns which you dont want by pressing respective keys.

      Example of output

      top - 17:06:20 up 43 days, 17:58, 1 user, load average: 0.00, 0.01, 0.05
      Tasks: 81 total, 0 running, 0 sleeping, 0 stopped, 0 zombie
      Mem: 1012912k total, 749008k used, 263904k free, 14772k buffers
      Swap: 524284k total, 49964k used, 474320k free, 323908k cached

      PID RES
      1 1072
      2 0
      3 0
      4 0
      5 0
      7 0
      8 0
      9 0
      10 0
      11 0

  2. I found this page to be most informative. I was able to customize my environment to my satisfaction.

    Thank you for the fine work!

    (I've been running Linux since the Slackware 1.2 kernel).


Leave a Comment