Tag: Linux processes

Do services need to be restarted when updating packages

Package configuration: whether to restart the service

During the installation of package updates and their configuration, the apt program may ask you to restart the service:

There are services installed on your system which need to be restarted when certain libraries, such as libpam, libc, and libssl, are upgraded. Since these restarts may cause interruptions of service for the system, you will normally be prompted on each upgrade for the list of services you wish to restart. You can choose this option to avoid being prompted; instead, all necessary restarts will be done for you automatically so you can avoid being asked questions on each library upgrade. Restart services during package upgrades without asking?

This message can be confusing, especially the phrase “cause interruptions of service for the system”. In fact, the essence is quite simple – the binaries have been updated and you need to restart the services that use them so that they start using the updated versions of the files.

The name of the package that requires the service to be restarted is in the upper left corner, in the screenshot it is libc6, i.e. “GNU C Library: Shared libraries”. It contains the standard libraries that are used by nearly all programs on the system. This package includes shared versions of the standard C library and the standard math library, as well as many others.

What kind of interruptions can a service restart cause?

Examples of the consequences of restarting services:

  • at the time of restarting the web server service, sites will be unavailable to users
  • when restarting the caching proxy server, the cache stored in RAM will be deleted
  • restarting network services can lead to connection drops (but in practice this does not always happen)

That is, the possible consequences of restarting services on the home computer are insignificant – you can safely restart.

As far as restarting services on a server, for example, restarting the SSH server usually doesn't break the connection. You need to evaluate the consequences of restarting other services based on your situation.

See also:

Why doesn’t the kill command kill the process?

The kill command is used to stop a process, the command syntax is:

sudo kill PROCESS-ID

Related article: What are the differences and how to use the kill, pkill and killall commands

You may run into a situation when using kill does not kill the process.

You can get the process ID knowing the name of the executable file with the command:

ps -e | grep 'NAME'

The same command can be used to check if the process is still running.

Related article: How to use ps command to monitor Linux processes

The kill command is usually sufficient to kill most processes. But it may be that some process does not react to ‘kill’ command at all, even if you run it with sudo.

The name of the “kill” command continues to mislead many, many users (including myself at the beginning). It is assumed that when you say “kill X” it means exactly “stop (kill) the process X”. But in reality, this is far from the case. The kill command just sends one of the signals to the process.

If kill is called without any parameters, it sends signal number 15 (SIGTERM). This signal can be ignored by the process. This signal notifies a process to put its things in order, and then the process itself exits correctly. This is a good way.

You can also “send” signal number 9 (SIGKILL), which the process cannot ignore. The process doesn't even recognize it, because the kernel ends the process, not the process itself. This is an evil way.

Processes can ignore some signals. If you send a SIGKILL, it will not be able to ignore it and will not perform preparatory actions to complete, such as saving data or cleaning up.


kill -9 PROCESS-ID

If you suspend a process with CTRL-z, it will ignore most of the signals while it is suspended (that is, until you fg or bg on the process).

Also note that in some very specific circumstances a process can be in a zombie/non-functional state that even SIGKILL cannot kill the process. In this case, you will need to find the parent process and kill the parent process.

Some say kill -9 <PID> always works. It's a delusion. There are situations where even kill -9 does not kill the process. For example, when the process is in state D (continuous sleep). The process enters this state every time it waits for I/O (usually not very long). So, if a process is waiting for I/O (for example, on a faulty hard disk) and it is not properly programmed (with a timeout), then you simply cannot kill the process. Whatever you do. You can simply try to make the file available to keep the process going.

What are the differences and how to use the kill, pkill and killall commands

How to shutdown a process by process id

Each of the kill, pkill and killall commands are used to stop processes in Linux. In “How to use ps command to monitor Linux processes”, we looked at a number of ways to identify processes, including name, command, user, and terminal. We also looked at ways to identify processes by their dynamic attributes such as CPU and memory usage.

One way or another, we can define the processes that are running. Knowing their process ID, we can (if needed) stop any of these processes with the kill command. If we wanted to kill process 898, we would use this format:

sudo kill 898

Please be aware that in some cases the process will not terminate and will not display any errors or warnings. In fact, this command is a “recommendation”, it “asks” the process to exit. See the article “Why doesn't the kill command kill the process?” for details.

How to disable a process knowing its name

The pkill command allows you to kill processes by name. Make sure you define the correct process! This command will end the top process.

sudo pkill top

How to stop multiple processes by name

If you have multiple copies of a process running, or the process spawned multiple child processes (as Google Chrome can do), how can you shutdown them all? It's just as easy. We are using the killall command.

We have two instances of top running:

ps -e | grep top

We can terminate both of them with this command:

sudo killall top

This time no response means no problem, that is, both of these processes have been stopped.

Before killing the process

Make sure it's the one you want and make sure it doesn't cause any problems. In particular, it is worth checking this with the ps command running with the -H and --forest options to make sure there are no important child processes that you forgot about. See “How to use ps command to monitor Linux processes” for details.

ps -f --forest -C sshd

See also: Why doesn't the kill command kill the process?

How to use ps command to monitor Linux processes

The ‘ps’ (processes status) command is a built-in Unix/Linux utility for viewing information regarding the selection of running processes on the system: it reads this information from virtual files in the /proc file system. It is one of the essential system administration utilities, especially in the context of process monitoring, to help you understand what is happening on a Linux system.

ps has many options for manipulating the output, but you will find a small number of them practically useful for daily use.

The ps utility displays a snapshot of the processes on your Linux machine. You will be able to find processes by name, user or even terminal with as much detail as you need. This article has prepared many examples of using ps.

Linux process control

The heart of all Linux and Unix-like operating systems is the kernel. Among its many responsibilities is the allocation of system resources such as RAM and CPU time. They must be executed in real time so that all running processes get their fair share according to the priority of each task.

Sometimes tasks can be locked, or get stuck, or stop responding for other reasons. Or they can continue to run, but gobble up too much processor time or RAM, or behave in some similar antisocial manner. Sometimes tasks need to be killed to keep the system running smoothly. Of course, the first step is to identify the problematic process.

But perhaps you have no problem with tasks or performance at all. Perhaps you're just curious about what processes are running on your computer and would like to look under the hood of the Linux operating system. The ps command meets both of these requirements. It gives you a snapshot of what is happening inside your computer “right now”.

ps is flexible enough to provide you with exactly the information you need, in exactly the format you like. In fact, ps has a lot of options. The options described here will suit most common needs. If you want to take a deeper look at the ps command, familiarizing yourself with the ps command in this article and examples of using ps will make the man page easier for you.

Program for showing processes in Linux

The easiest way to use ps is to run it without parameters:


ps will show the list of processes in the given terminal.

There are four columns in the output:

  • PID: process identification number.
  • TTY: The name of the console the user is signed in to.
  • TIME: The amount of CPU time that the process consumed.
  • CMD: the name of the command that started the process

How to see all processes in Linux

Adding the -e (select all processes) option will make ps list the processes that were started by all users, not just the user running the ps command. Since this will be a long list, you can add the less command.

ps -e | less

Scrollable list of processes in less command:

There are many more process records now, but we see the same four columns as before. A question mark (?) In the TTY column means that the process was not started from a terminal window.

Displaying the hierarchy of processes (process tree in Linux)

If you see what processes other processes have started, sometimes it can help you figure out a problem or identify a specific process. For this we use the -H option.

ps -eH | less

Indentation indicates which processes are the parents of which other processes.

To add some clarity, we can ask ps to add some ASCII lines and draw a tree-like hierarchy. This can be done with the --forest option.

ps -e --forest | less

This makes it easier to keep track of which processes are the parents of other processes.

How to print a tree of a specific process

You can get the process tree of only the program you need as follows (replace “sshd” with the process you are interested in):

ps -f --forest -C sshd

Or like this:

ps -ef --forest | grep -v grep | grep sshd

The -C option will be discussed later in this article.

Filtering ps output by specific lines (by command name, for example)

You can pipe the output from ps through grep and find the process entries you want along any lines. Here we are looking for entries matching the search term “firefox”:

ps -e | grep firefox

In this case, the output is a single record for the process of interest. Of course, if we were running multiple instances of Firefox, there would be more than one item in the list.

More columns in ps output

To add additional columns to the output, use the -f (full format) option.

ps -ef | less

An additional set of columns is included in the ps output.

The following new columns have been added:

  • UID: User ID of the owner of this process.
  • PPID: Parent Process ID.
  • C: The number of children the process has.
  • STIME: Start time. The time when the process was started.

Using the -F (extra full format) option, we can get even more columns:

ps -eF | less

If you have a small terminal window, the columns we get this time require scrolling to the side to show them all. Pressing the Right Arrow key (→) shifts the display to the left.

The following columns have now been added:

  • SZ: The size of the RAM pages of the process image.
  • RSS: Resident Set Size. It is not the swapped physical memory used by the process.
  • PSR: The processor to which the process is assigned.

Do I need to put a hyphen in front of ps options

In some examples, you may see ps used with non-hyphen options or with long GNU-style options. For compatibility, ps supports all three formats. Non-hyphenated options are BSD style and the meaning of hyphenated and non-hyphenated options can be different!

An example of showing processes in BSD format:

ps au
# OR
ps axu

In this command, the meaning of the options is as follows:

  • u – user oriented format
  • a – removes the restriction “only own processes”
  • x – removes the restriction “only processes with a terminal”

Simply put, if you use “a” and “x” together, then all processes will be shown.

Be careful not to forget to hyphenate if you are using UNIX options, since ps will try to interpret it differently if it is ambiguous. In this manual, except for the example shown above, UNIX options are used everywhere.

Search for processes by process ID

Once you have found the process ID for the process you are interested in, you can use it with the ps command to display detailed information about that process. To do this, use the -p parameter after which specify a number – the process ID:

ps -p 3403

More than one process ID can be specified, separated by commas or spaces.

Search for processes by command name

The -C COMMAND option allows you to search for a process using the command name. That is, the name of the command that started the process. This is slightly different from a command line, which can include path names and parameters or options.

ps -F -C soffice.bin

Only information about the process started by the specified command is displayed:

There can be several processes if many instances of this command are running:

ps -F -C bash

How to see the flows of a process

To list all threads in a process, use the -H flag. The -L option will display the LWP (light weight process) column as well as the NLWP (number of light weight process) column.

ps -fL -C httpd

How to see the processes of a specific user

To see the processes owned by a specific user, use the -u USERNAME LIST option:

ps -u mial

Processes belonging to the mial user account are displayed.

How to list all processes started by root user

This is a special case of showing the processes of a certain user.

The command below allows you to view each process running with root privileges (a valid and effective identifier) in user format.

ps -U root -u root

Viewing group processes

If you want to list all processes belonging to a specific group (real group ID (RGID) or name), enter:

ps -fG www-data
ps -fG 33

To list all processes belonging to the effective group (or session) name, enter.

ps -fg www-data

Listing processes by terminal

To see the processes associated with a TTY, use the -t SPECIFY TTY option. When used without a TTY number, the -t option reports the processes associated with the current terminal window.

ps -t 1

All listed processes are associated with pts/1.

Selecting columns to display

With the -o FORMAT option, you can choose which columns you want to include in the ps output. Columns must be specified by name. From the ps manual:

man ps

you'll find a long list of column names in the “STANDARD FORMAT SPECIFIERS” section.

In the following example, we display the CPU time consumed by the process (pcpu), the processor's memory consumption (pmem) and the command that ran it along with the options (args):

ps -e -o pcpu,pmem,args | less

Note that the -o option does not add columns to the default set, but only displays the indicated fields.

Sorting output by columns

You can sort the output using the --sort option. Let's sort the output by the CPU column:

ps -e -o pcpu,pmem,args --sort -pcpu | less

The hyphen “-” means sorting from highest to lowest.

To see the ten most resource-intensive processes, pipe the output through the head command:

ps -e -o pcpu,args,args --sort -pcpu | head -10

We get a sorted, truncated list.

If we add more columns to display, we can sort by more columns.

Without a hyphen or with a “+” sign, sorting is performed from smallest to largest.

Let's add the pmem column to the sort:

ps -e -o pcpu,pmem,args --sort -pcpu,pmem

Sorting is still performed by pcpu value, but if these values are the same for some records, then pmem sort is performed for these values.

Let's make the output a little more useful and add a process id (pid) column so we can see the process number of each process in our listing.

ps -e -o pid,pcpu,pmem,args --sort -pcpu,pmem | head -10

We can now identify the processes.

All possible ps fields

To see all possible ps fields, run this command:

ps L

You can use these fields with the -o option.

Custom ps output examples

The command below allows you to see the PID, PPID, username and command of the process.

ps -eo pid,ppid,user,cmd

Below is another example of a custom output format showing the file system group, nice value, start time, and elapsed time of the process.

ps -p 1154 -o pid,ppid,fgroup,ni,lstart,etime

How to find the name of a process by PID

To find the name of a process using its PID.

ps -p 1154 -o comm=

Show parent and child processes

To select a specific process by its name, use the -C flag, this will also display all of its child processes.

ps -C sshd

To find all PIDs of all process instances, which is useful when writing scripts that need to read the PIDs from the stdin.

ps -C httpd -o pid=

How to shutdown a process by process id

We've covered a number of ways to identify processes, including name, command, user, and terminal. We also looked at ways to identify processes by their dynamic attributes such as CPU and memory usage.

One way or another, we can define the processes that are running. Knowing their process ID, we can (if needed) stop any of these processes with the kill command. If we wanted to kill process 898, we would use this format:

sudo kill 898

See also: What are the differences and how to use the kill, pkill and killall commands

Please be aware that in some cases the process will not terminate and will not display any errors or warnings. In fact, this command is a “recommendation”, it “asks” the process to exit. See the article “Why doesn't the kill command kill the process?” for details.

How to disable a process knowing its name

The pkill command allows you to kill processes by name. Make sure you define the correct process! This command will end the top process.

sudo pkill top

How to stop multiple processes by name

If you have multiple copies of a process running, or the process spawned multiple child processes (as Google Chrome can do), how can you shutdown them all? It's just as easy. We are using the killall command.

We have two instances of top running:

ps -e | grep top

We can terminate both of them with this command:

sudo killall top

Usually no response means no problem, that is, both of these processes have been stopped.

Before killing the process

Make sure it's the one you want and make sure it doesn't cause any problems. In particular, it is worth checking with the -H and --forest options to make sure there are no important child processes that you forgot about.

Troubleshooting Linux system performance

If your system is not working properly, for example, if it is unusually slow, you can troubleshoot some system problems as follows.

To find all the processes consuming the most memory and CPU in Linux:

ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head


ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head

Displaying security information

You can show the security context (specifically for SELinux) as follows:

ps -eM


ps --context

You can also display security information in a user-defined format with this command:

ps -eo euser,ruser,suser,fuser,f,comm,label

Monitor your processes in real time with the watch utility

Finally, because ps displays static information, you can use the watch utility to continuously update the screen information and monitor processes in real time with repeated output. In this example, the information will be updated every second. Specify your own ps command to suit your purpose.

watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'

See also:

htop command guide: how to view processes in Linux interactively

Is htop better or top?

The htop command is similar to top in function: they both display real-time information about processes, display system resource consumption, and allow you to search, stop, and manage processes.

Both commands have their own advantages. For example, the htop program implements a very convenient process search and filtering. In the top command, this is not so convenient – you need to know the button to display the search function.

But in top, you can split the window area and display information about processes in accordance with different settings. In general, top is much more flexible in customizing the display of processes.

In general, to decide which command is best for you, try both of them. This article will go into detail about htop, to get familiar with top refer to the article “How to use the top command to monitor Linux processes”.

How to install htop

Install a package named htop using your distribution's package manager.

On Debian, Linux Mint, Ubuntu, Kali Linux and their derivatives, run:

sudo apt install htop

On Arch Linux, Manjaro, BlackArch and derivatives run:

sudo pacman -Syu htop

How to view all processes in Linux

The htop command can be run by a regular user:


So to run it with superuser privileges, use sudo for this:

sudo htop

Superuser rights are needed only for some actions: to change the priority (nice) of processes, to close the processes of other users.

As with the top program, the window is divided into two main sections:

  • generalized information about the system
  • detailed information on processes

System information area

At the very top, the load on each core of the central processor is shown (numbers from 1 to 12).

Mem – the total amount of RAM and the memory used.

Task – generalized statistics on processes

Swp – swap file consumption level (if any)

Load average – average CPU load

Uptime – operating system uptime since the last boot

Now let's move on to the area with information about running processes.

Htop columns value

The htop program displays the following columns:


Process ID.


The username of the owner of the process, or ID if the name cannot be determined.


Priority is the internal kernel priority for the process, usually just nice plus twenty. Differs for processes with real-time execution priority.


NICE process value from 19 (low priority) to -20 (high priority). A higher value means that the process is “nice” to others and allows them to have a higher execution priority.


Process virtual memory size (M_SIZE).


The size of the resident set (text + data + stack) of the process (i.e. the size of the physical memory used by the process, M_RESIDENT).


The size of the shared pages of the process (M_SHARE).


STATE, the state of the process, can be:

S for sleeping (idle)

R for running

D for disk sleep (uninterruptible)

Z for zombie (waiting for parent to read its exit status)

T for traced or suspended (e.g by SIGTSTP)

W for paging


The percentage of CPU the process is currently using.


The percentage of memory the process is currently using (depending on the size of the process resident memory, see M_RESIDENT above).


The time measured in hours indicates how much the process has spent in user and system time.


The complete command line of the process (that is, the program name and arguments).

How to speed up or slow down the htop refresh rate

To set the update time for htop, use the -d option, after which specify the update time in tenths of seconds. For example, to make the program refresh the window every 1/10th of a second:

sudo htop -d 1

To make the program display new data every 5 seconds:

sudo htop -d 50

How to display processes in the form of a tree

To list processes as a tree, use the -t option:

sudo htop -t

Or, while the program is running, press the F5 key:

How to navigate the list of processes in htop

You can use the cursor keys (, , , ) to scroll through the list of processes.

The “PgUp”, “PgDn” keys also work for scrolling the window.

The “Home” button will move to the top of the list.

The “End” button will scroll to the end of the list.

Ctrl-a or ^ – scroll to the beginning of the item (beginning of the line).

Ctrl-e or $ – scrolls to the end of a process entry item (that is, the end of a line).

How to sort by memory consumption in htop. How to choose a field to sort

Press F6 to select the field you want to use for sorting.

To switch to the reverse sorting order, use the “I” (Shift+i) key. Pressing again will re-sort the list in reverse order.

How to collapse branches of a process tree in htop

In process tree mode, select the tree branch you want to collapse and press F6.

Searching and filtering processes in htop

Search differs from filtering in that the found processes are shown along with the rest, and you can switch between the found processes by pressing F3.

When filtering, only processes that match the pattern will be displayed on the screen.

Press F3 or “/” to go to process search. Press F3 to switch between found processes.

To filter processes, press F4 or “\” start typing the process name.

Press F4 and then Esc again to clear the filter.

How to change the priority of a process in htop

To increase the priority of the process (subtract from the nice value) press the F7 or “]” key. Remember that only the superuser can do this operation (you must be root or run htop with sudo).

To decrease the priority of the process (add to the nice value) press the F8 or “[” key.

How to select one or more processes in htop

Use “Space” to select processes. After that, the entered commands, such as kill or changing the priority, can be applied to the group of selected processes instead of the currently highlighted one.

To deselect all processes, press “U” (Shift+u).

How to close a process in htop

To close a process, select one or more processes and press F9 or “k”. A termination signal will be sent to the selected process. If no process is marked, then the one on which the cursor is currently located will be closed.

How to show the files that a process is using

If you want to see the files opened by the process, then highlight the process you are interested in and press the “l” (small Latin L) button.

The lsof utility must be installed on the system for this feature to work.

See also: How to use lsof to view open files (on Linux, everything is files)

How to change the appearance of htop

To change the appearance of the panel with information about the system, displayed columns, etc., press the F2 or “S” (Shift+s) button.

There you will see the following tabs:

  • Meters (information displayed at the top of the window about the CPU, memory, etc.)
  • Display options
  • Colors
  • Columns (change the order of columns, add and remove columns)

How to specify the field to sort when starting htop

Using the -s option, you can specify the column by which the processes will be sorted.

For example, to sort processes by the PERCENT_MEM column (percentage of memory used):

sudo htop -s PERCENT_MEM

To see all available columns for sorting, run the command:

htop --sort-key help

How to show only processes of a specific user

Use the -u option to a command like:

sudo htop -u USER

For example, to display processes of only user named mial:

sudo htop -u mial

How to show only the process with a certain number

To monitor only some processes, use the -p PID,PID… option. You can separate one or more process IDs, separated by commas. Only these processes will be shown in the htop window.

System call tracing

You can trace what system calls the process made. To do this, select the process you are interested in and press the “s” button.

For this function to work, you must have the strace utility installed.

How to close htop

Press F10 or “q” or Ctrl+c to exit the program.

If htop isn't enough for you, see “How to use the top command to monitor Linux processes”.

How to use the top command to monitor Linux processes

“top” program for showing Linux processes in real time

The top program shows the program and service processes running on Linux.

With top, you can see the dynamics of a running system in real time. The program displays a summary of the system information, as well as a list of processes or threads currently served by the Linux kernel.

You can customize what kind of information about the system and processes is displayed and in what form. This is exactly what this article is about – it'll show you how you can get the most out of top by controlling its appearance and output. You can completely customize the program for yourself for the most convenient perception of information and display the information that is absent in the standard mode. This can be done within the current launch of the program, or you can save the changes so that you do not have to tune the top every time.

Example top interface after configuration:

In addition to comprehensive customization options, the program provides a limited interactive process control interface.

By the way, the top program has an interesting analogue, for details see the article “htop command guide: how to view processes in Linux interactively”.

How to see running processes in Linux (similar to the Windows task manager)

To see which processes are running, run:


What do the numbers in top mean (how to understand the output of top)

Let's start with a brief description of the standard top interface. As already mentioned, it can be almost completely configured to suit your preferences.

The upper part of the program shows a brief summary of the processor and RAM usage of the system.

The topmost row shows: current time in the system, uptime (working time after booting), total number of users and average load for the last 1, 5 and 15 minutes.

Then there are lines with information about:

  • tasks
  • processor
  • random access memory
  • swap partition

Next is the list of running processes. By default, the following information is displayed:

PID – unique identifier of the process

USER – the name of the user who owns the task

PR – priority of the task in the schedule. If you see “rt” in this field, it means that the task is running in the real-time priority schedule (the highest priority).

NI – the nice value of the task. A negative value means a higher priority, and a positive nice value means a lower priority.

VIRT – the total amount of virtual memory used by the task, includes all codes, data, shared libraries, plus pages that have been swapped and pages that have been allocated but not in use

RES – used RAM, is a subset of VIRT, represents physical memory not placed in the swap partition, which is currently being used by the task. Also is the sum of the RSan, RSfd and Rssh fields.

SHR – shared memory size, a subset of the used RES memory that can be used by other processes

S – process status. May be:

  • D = uninterruptible sleep
  • I = idle
  • R = running
  • S = sleeping
  • T = stopped by job control signal
  • t = stopped by debugger during trace
  • Z = zombie

%CPU – CPU usage, the share of the task in the consumed CPU time since the last screen refresh, expressed as a percentage of the total CPU time

%MEM – task share in memory usage (RES)

TIME+ – the total CPU time that the task has been using since starting

COMMAND – Command name or Command string. Shows the command line used to start the task or the name of the associated program

Scrolling top windows

You can scroll the list of processes up and down, as well as right and left, using the cursor keys (arrows).

Show and hide total load/uptime

Let's start with something very simple – you can remove or return the top line showing the load and uptime, for this press the “l” key.

Switch to color mode

Pressing “z” switches between monochrome and color display.

The color scheme can be customized, that is, you can set your own colors.

Show the load of each core

Using button “1”, you can switch and display generalized information about the processor load in one line, or in several lines for each core.

Displaying a histogram of CPU utilization

The “t” button in a circle toggles the view of the line of generalized information about the processor usage. The options are:

1. detailed percentages by category

2. abbreviated user/system and total % + bar graph

3. abbreviated user/system and total % + block graph

4. turn off task and CPU states display

In my screenshot, instead of histograms, there are white areas – the processor is simply idle, there are few running tasks at the moment.

Displaying a histogram of memory load

The “m” switch works similarly to the previous one, but for RAM (physical and virtual). Four similar modes:

1. detailed percentages by memory type

2. abbreviated % used/total available + bar graph

3. abbreviated % used/total available + block graph

4. turn off memory display

Using bold selection

Some data, such as tasks that consume a lot of CPU time, are highlighted in bold. This is the default behavior. It can be disabled/enabled with the “b” command.

Column highlighting used for sorting

The list of processes is not shown in random order – it is sorted by a specific value. You can sort by different columns. And if you forgot which column is used for sorting, then press the “x” button and this column will be highlighted in bold. Press “x” again to return to the original state.

Show run command (Command-Line/Program-Name toggle)

You can see the Command-Line that launched it (the program name along with the command line options) using the “c” button. To return to displaying the Program-Name, press “c” again.

How to view the processes of only a certain user

Use the “u” or “U” key and then enter the username for which you want to see processes. The -u option matches only the effective user, while -U matches any user (real, effective, saved, or filesystem).

Only processes of the specified user will be shown, or a blank screen if there are no processes. Before the username, you can put “!” (exclamation mark) and then processes will be shown for all users except the specified one.

Tree view of processes and child processes

Using the “V” key, you can switch to the tree view and back. In this mode, processes are reorganized according to their parents and the COMMAND column shows this tree.

A capital letter “V” means that you need to press Shift+v at the same time.

In the tree view, you can still use the interactive “c” command to switch to the command line view. An interactive “H” command is also available to switch between processes and threads.

Show only active processes

With the “i” button, you can switch between all or only active tasks.

View threads (threads-mode toggle)

By default, top displays a summary of all threads in each process. Using “H” you can switch to show threads. When this toggle is On, individual threads will be displayed for all processes in all visible task windows. Otherwise, top displays a summation of all threads in each process.

How to change the update interval of information in top

By default, the information is updated every three seconds. Using the “d” or “s” interactive command, you can enter set any other interval. After pressing one of these buttons, you will need to enter a value in seconds. You can enter fractional numbers, but you cannot enter negative numbers. If you enter “0”, the program will continuously update information and consume a lot of CPU time.

If you want to know what delay time is currently set, press “h” and in the second line find the line with the word “Delay”.

How to change sorting of processes / How to sort by used memory

By default, sorting is performed by the amount of CPU usage – the more a task consumes CPU resources, the higher it is in the list. If you switch to the tree view mode, this rule does not apply. You can also sort by other process characteristics. For example, by the volume of consumed RAM.

To switch between different columns (to select another characteristic for sorting) use the “<” and “>” keys. These are not cursor keys. These are symbols in the English layout, which are located in the lower right corner of the keyboard. To send this character, you need to press “Shift”.

As mentioned above, to see which column is being sorted, press “x”.

How to search top

You can search for processes and strings containing a specific value.

To do this, press “L” (Shift+l), you will be prompted to enter a search word. Search is case sensitive. There are no restrictions on the content of the search bar.

Searches are not limited to values from a single column. All values shown in task lines are allowed to be searched by them. You can include spaces, numbers, symbols.

Send the “&” character to jump to the next match in your search.

If search is active, top will disable column highlighting to prevent confusion with search results. That is, “x” will lose its effect. Column highlighting will be restored when the search is stopped. To do this, you can specify an empty value as the search string.

Reset filters

To reset filters, “=” and “+” are used. Their actions are slightly different, the “=” button acts on the currently visible task window. And the “+” button affects all windows in the alternate display. Filters set with:

  • i (no inactive tasks)
  • n (maximum number of tasks)
  • u/U (filter by users),
  • o/O (different filter)
  • L (search)

Field controls

You can add or remove fields. To do this, press “f” or “F”. A new window will open:

In it, select the field you are interested in, to add it, press “d”, to sort by the selected field, press “s”.

Multi-window top mode (how to enable multiple tabs in top)

The top program supports multiple windows – up to four. Moreover, in each of them, you can make completely different settings and observe the various characteristics of the system.

The multi-window top view is called alternate-display mode. To turn it on, press “A”. To cycle through the windows, press “a” (move to next) or “w” (return to previous). To find out which window is currently open, look at the topmost line (if you have not disabled it with the “l” button) – it will contain the number and name of the active window.

You can quickly switch between windows using the interactive “g” command. After pressing it, you will need to enter numbers from 1 to 4. By the way, the “g” command works both in multi-window mode and in single-window mode. In the latter case, it also switches to another window.

You can set the window name (which is displayed at the very top, for this use the “G” command. After sending it, you will need to enter a new name for the current window.

For each window, you can set its own set of fields, independent of other windows, customize sorting and display.

How to make 2 or 3 windows in top instead of 4

It is possible that 4 windows are too many for you. You can hide some windows and thus get 2 or 3 active windows. To hide or show the currently active window, use the “-” (dash) button.

The “_” button works the same way, but for all windows at once.

An example of a two-window mode, in the first window I observe for applications that create the maximum load on the processor (sorting by %CPU, only active processes are shown), in the second window I observe the applications that consume the most RAM (sorting by %MEM):

How to stop a process through top

To end the process (service), press “k”. Then you will need to enter the PID of this process and the signal to send (you can leave the default value).

By default, the SIGTERM signal is sent, but you can send any by specifying the signal number or its name.

Changing the nice value of a process

To change the nice value of a process press “r”, you will be prompted to enter the PID and then the nice value to assign to it.

A positive nice value means that the process has lost priority. Conversely, a negative nice value will make the process more favored by the kernel. As a general rule, ordinary users can only increase the nice value and are prevented from lowering it.

How to use top in scripts

top also supports command line options. Most of these options correspond to the interactive commands discussed above – but must be preceded by a dash.

The top program itself can be used in scripts. The -b option is used to execute the command in this mode. This option is useful for sending top output to another program or file. In this mode, top will not accept input and will run until the repetition limit is reached, which is set with the -n switch. For example, running the top command in batch mode with one update of information:

top -b -n 1

Saving top settings

Use the interactive “W” command to write the configuration file. It will keep all your options and switches, plus the current display mode and delay time. By typing this command before exiting top, you can then restart it in exactly the same state.

The program will report where it saved the configuration file. This is usually the ~/.config/procps/toprc file. That is, if you want to reset your custom top settings, then delete this file.

Also see the article htop command guide: how to view processes in Linux interactively.