How to use the top command to monitor Linux processes

“top” program for showing Linux processes in real time

The top program shows the program and service processes running on Linux.

With top, you can see the dynamics of a running system in real time. The program displays a summary of the system information, as well as a list of processes or threads currently served by the Linux kernel.

You can customize what kind of information about the system and processes is displayed and in what form. This is exactly what this article is about – it'll show you how you can get the most out of top by controlling its appearance and output. You can completely customize the program for yourself for the most convenient perception of information and display the information that is absent in the standard mode. This can be done within the current launch of the program, or you can save the changes so that you do not have to tune the top every time.

Example top interface after configuration:

In addition to comprehensive customization options, the program provides a limited interactive process control interface.

By the way, the top program has an interesting analogue, for details see the article “htop command guide: how to view processes in Linux interactively”.

How to see running processes in Linux (similar to the Windows task manager)

To see which processes are running, run:


What do the numbers in top mean (how to understand the output of top)

Let's start with a brief description of the standard top interface. As already mentioned, it can be almost completely configured to suit your preferences.

The upper part of the program shows a brief summary of the processor and RAM usage of the system.

The topmost row shows: current time in the system, uptime (working time after booting), total number of users and average load for the last 1, 5 and 15 minutes.

Then there are lines with information about:

  • tasks
  • processor
  • random access memory
  • swap partition

Next is the list of running processes. By default, the following information is displayed:

PID – unique identifier of the process

USER – the name of the user who owns the task

PR – priority of the task in the schedule. If you see “rt” in this field, it means that the task is running in the real-time priority schedule (the highest priority).

NI – the nice value of the task. A negative value means a higher priority, and a positive nice value means a lower priority.

VIRT – the total amount of virtual memory used by the task, includes all codes, data, shared libraries, plus pages that have been swapped and pages that have been allocated but not in use

RES – used RAM, is a subset of VIRT, represents physical memory not placed in the swap partition, which is currently being used by the task. Also is the sum of the RSan, RSfd and Rssh fields.

SHR – shared memory size, a subset of the used RES memory that can be used by other processes

S – process status. May be:

  • D = uninterruptible sleep
  • I = idle
  • R = running
  • S = sleeping
  • T = stopped by job control signal
  • t = stopped by debugger during trace
  • Z = zombie

%CPU – CPU usage, the share of the task in the consumed CPU time since the last screen refresh, expressed as a percentage of the total CPU time

%MEM – task share in memory usage (RES)

TIME+ – the total CPU time that the task has been using since starting

COMMAND – Command name or Command string. Shows the command line used to start the task or the name of the associated program

Scrolling top windows

You can scroll the list of processes up and down, as well as right and left, using the cursor keys (arrows).

Show and hide total load/uptime

Let's start with something very simple – you can remove or return the top line showing the load and uptime, for this press the “l” key.

Switch to color mode

Pressing “z” switches between monochrome and color display.

The color scheme can be customized, that is, you can set your own colors.

Show the load of each core

Using button “1”, you can switch and display generalized information about the processor load in one line, or in several lines for each core.

Displaying a histogram of CPU utilization

The “t” button in a circle toggles the view of the line of generalized information about the processor usage. The options are:

1. detailed percentages by category

2. abbreviated user/system and total % + bar graph

3. abbreviated user/system and total % + block graph

4. turn off task and CPU states display

In my screenshot, instead of histograms, there are white areas – the processor is simply idle, there are few running tasks at the moment.

Displaying a histogram of memory load

The “m” switch works similarly to the previous one, but for RAM (physical and virtual). Four similar modes:

1. detailed percentages by memory type

2. abbreviated % used/total available + bar graph

3. abbreviated % used/total available + block graph

4. turn off memory display

Using bold selection

Some data, such as tasks that consume a lot of CPU time, are highlighted in bold. This is the default behavior. It can be disabled/enabled with the “b” command.

Column highlighting used for sorting

The list of processes is not shown in random order – it is sorted by a specific value. You can sort by different columns. And if you forgot which column is used for sorting, then press the “x” button and this column will be highlighted in bold. Press “x” again to return to the original state.

Show run command (Command-Line/Program-Name toggle)

You can see the Command-Line that launched it (the program name along with the command line options) using the “c” button. To return to displaying the Program-Name, press “c” again.

How to view the processes of only a certain user

Use the “u” or “U” key and then enter the username for which you want to see processes. The -u option matches only the effective user, while -U matches any user (real, effective, saved, or filesystem).

Only processes of the specified user will be shown, or a blank screen if there are no processes. Before the username, you can put “!” (exclamation mark) and then processes will be shown for all users except the specified one.

Tree view of processes and child processes

Using the “V” key, you can switch to the tree view and back. In this mode, processes are reorganized according to their parents and the COMMAND column shows this tree.

A capital letter “V” means that you need to press Shift+v at the same time.

In the tree view, you can still use the interactive “c” command to switch to the command line view. An interactive “H” command is also available to switch between processes and threads.

Show only active processes

With the “i” button, you can switch between all or only active tasks.

View threads (threads-mode toggle)

By default, top displays a summary of all threads in each process. Using “H” you can switch to show threads. When this toggle is On, individual threads will be displayed for all processes in all visible task windows. Otherwise, top displays a summation of all threads in each process.

How to change the update interval of information in top

By default, the information is updated every three seconds. Using the “d” or “s” interactive command, you can enter set any other interval. After pressing one of these buttons, you will need to enter a value in seconds. You can enter fractional numbers, but you cannot enter negative numbers. If you enter “0”, the program will continuously update information and consume a lot of CPU time.

If you want to know what delay time is currently set, press “h” and in the second line find the line with the word “Delay”.

How to change sorting of processes / How to sort by used memory

By default, sorting is performed by the amount of CPU usage – the more a task consumes CPU resources, the higher it is in the list. If you switch to the tree view mode, this rule does not apply. You can also sort by other process characteristics. For example, by the volume of consumed RAM.

To switch between different columns (to select another characteristic for sorting) use the “<” and “>” keys. These are not cursor keys. These are symbols in the English layout, which are located in the lower right corner of the keyboard. To send this character, you need to press “Shift”.

As mentioned above, to see which column is being sorted, press “x”.

How to search top

You can search for processes and strings containing a specific value.

To do this, press “L” (Shift+l), you will be prompted to enter a search word. Search is case sensitive. There are no restrictions on the content of the search bar.

Searches are not limited to values from a single column. All values shown in task lines are allowed to be searched by them. You can include spaces, numbers, symbols.

Send the “&” character to jump to the next match in your search.

If search is active, top will disable column highlighting to prevent confusion with search results. That is, “x” will lose its effect. Column highlighting will be restored when the search is stopped. To do this, you can specify an empty value as the search string.

Reset filters

To reset filters, “=” and “+” are used. Their actions are slightly different, the “=” button acts on the currently visible task window. And the “+” button affects all windows in the alternate display. Filters set with:

  • i (no inactive tasks)
  • n (maximum number of tasks)
  • u/U (filter by users),
  • o/O (different filter)
  • L (search)

Field controls

You can add or remove fields. To do this, press “f” or “F”. A new window will open:

In it, select the field you are interested in, to add it, press “d”, to sort by the selected field, press “s”.

Multi-window top mode (how to enable multiple tabs in top)

The top program supports multiple windows – up to four. Moreover, in each of them, you can make completely different settings and observe the various characteristics of the system.

The multi-window top view is called alternate-display mode. To turn it on, press “A”. To cycle through the windows, press “a” (move to next) or “w” (return to previous). To find out which window is currently open, look at the topmost line (if you have not disabled it with the “l” button) – it will contain the number and name of the active window.

You can quickly switch between windows using the interactive “g” command. After pressing it, you will need to enter numbers from 1 to 4. By the way, the “g” command works both in multi-window mode and in single-window mode. In the latter case, it also switches to another window.

You can set the window name (which is displayed at the very top, for this use the “G” command. After sending it, you will need to enter a new name for the current window.

For each window, you can set its own set of fields, independent of other windows, customize sorting and display.

How to make 2 or 3 windows in top instead of 4

It is possible that 4 windows are too many for you. You can hide some windows and thus get 2 or 3 active windows. To hide or show the currently active window, use the “-” (dash) button.

The “_” button works the same way, but for all windows at once.

An example of a two-window mode, in the first window I observe for applications that create the maximum load on the processor (sorting by %CPU, only active processes are shown), in the second window I observe the applications that consume the most RAM (sorting by %MEM):

How to stop a process through top

To end the process (service), press “k”. Then you will need to enter the PID of this process and the signal to send (you can leave the default value).

By default, the SIGTERM signal is sent, but you can send any by specifying the signal number or its name.

Changing the nice value of a process

To change the nice value of a process press “r”, you will be prompted to enter the PID and then the nice value to assign to it.

A positive nice value means that the process has lost priority. Conversely, a negative nice value will make the process more favored by the kernel. As a general rule, ordinary users can only increase the nice value and are prevented from lowering it.

How to use top in scripts

top also supports command line options. Most of these options correspond to the interactive commands discussed above – but must be preceded by a dash.

The top program itself can be used in scripts. The -b option is used to execute the command in this mode. This option is useful for sending top output to another program or file. In this mode, top will not accept input and will run until the repetition limit is reached, which is set with the -n switch. For example, running the top command in batch mode with one update of information:

top -b -n 1

Saving top settings

Use the interactive “W” command to write the configuration file. It will keep all your options and switches, plus the current display mode and delay time. By typing this command before exiting top, you can then restart it in exactly the same state.

The program will report where it saved the configuration file. This is usually the ~/.config/procps/toprc file. That is, if you want to reset your custom top settings, then delete this file.

Also see the article htop command guide: how to view processes in Linux interactively.

Leave Your Observation

Your email address will not be published.