30 Top Command Examples for Monitoring in Linux

The top command in Linux displays the running processes on the system. One of the most important tools for a system administrator. It is used extensively for monitoring the load on a server. In this article, we explore the top command in detail. The top command is an interactive command. Many commands are available when top is running. We will explore these commands as well.

1. Default Top Command

First of all, let us understand what the output says. Top command displays a lot of information about the running system. But we need to understand the meaning of different sections of this output. To see running process, on terminal run the command below

# top

Running by default, the top command displays output like this:

There are some information in differents columns and  horizontals lines showing summary about different system parameters, and following these are the processes and their attributes in columns.

a) Fields/Columns

By default, top shows some attributes associated with processes and the type of information is represented in column. So to understand how the top command functions, we must know the role of each column in order to know where is to information that  we should need

PID: The Process ID represented by a unique value which uniquely identifies a process.

USER: The effective user name of the owner of the processes. It helps to exactly identify the processes launched by a particular user

PR: it is the process's actual priority, as viewed by the Linux kernel, the scheduling priority of the process. For normal processes, the kernel priority is simply +20 from the nice value. Thus a process with the neutral nice value of zero has a kernel priority of 20. For processes running under real-time, the value of the field is RT

NI: It is the nice value of the process corresponding to a user-space concept. Nice value range is -20 to +19 where -20 is highest, 0 default and +19 is lowest. Lower values mean higher priority. The relation between nice value and priority is PR = 20 + NI

VIRT: It is the amount of virtual memory used by the process. It represents how much memory the program is able to access at the present moment; it stands for the virtual size of a process, which is the sum of memory it is actually using,

RES: It is the resident memory size. Resident memory is the amount of non-swapped physical memory a task is using. It stands for the resident size, which is an accurate representation of how much actual physical memory a process is consuming. (This also corresponds directly to the %MEM column.) This will virtually always be less than the VIRT size, since most programs depend on the C library.

SHR: SHR is the shared memory used by the process and it indicates how much of the VIRT size is actually sharable (memory or libraries). In the case of libraries, it does not necessarily mean that the entire library is resident.

S: This is the process status. Processes are defined by a functioning state. It can have one of the following values:

• D - uninterruptible sleep: a sleep state where the process is waiting for something to happen. It cannot be interrupted by a signal; it is usually seen when the process is waiting for the disk.
• R - running: the process is ready to run, and will run whenever its turn to use the CPU comes
• S - sleeping: a sleep state where the process is waiting for something to happen. It can be interrupted by a signal
• T - traced or stopped: it is a state where the process is stopped, usually via SIGSTOP or SIGTSTP. It can also be stopped by a debugger (ptrace). When you see that state, it is usually because you used Ctrl-Z to put a command in the background.
• Z - zombie: is a state where the process is dead (it has finished its execution), and the only thing left is the structure describing it on the kernel. It is waiting for its parent process to retrieve its exit code, and not much more. After its parent process is finished with it, it will disappear.

%CPU: It is the percentage of CPU time the task has used since last update. The percentage of the CPU that is being used by the process. By default, top displays this as a percentage of a single CPU. On multi-core systems, you can have percentages that are greater than 100%.

%MEM: It represents the percentage of available physical memory used by the process. It can be considered like the share of total available memory used by that process.

TIME+: The total CPU time the task has used since it started, with precision up to hundredth of a second.

COMMAND: The command which was used to start the process.

There are many other outputs which are not displayed by default which can display information about page faults, effective group and group ID of the process, and many more.

b) Uptime and Load Averages

When you are in the "top mode", at the first line of the result of top command, it is displayed an output similar to uptime command.

The fields display the information below:
* the current time of the system
* the time your system is been up
* number of users logged in the system
* load average of 5, 10 and 15 minutes respectively.
This uptime display can be toggled with l key and can hide the load average information.

c) Tasks

The second line shows the summary of tasks or processes. The processes can be in different states as we have seen above for the 'S' column. It shows the differents processes and its states

d) CPU States

The third line shows the differents  CPU statitics.

The meaning of different CPU times are:

• us, user: it shows us that the processor is spending 1.8% of its time running user space processes. A user space program is any process that doesn't belong to the kernel.
• sy, system: it is the amount of time that the CPU spent running the kernel.
• ni, niced: shows how much time the CPU spent running user space processes that have been niced. On a system where no processes have been niced then the number will be 0.
• id, idle: it tells us that the processor was idle just over 97% of the time during the last sampling period.
• wa, IO wait: it is idle while waiting for an I/O operation to complete
• hi: how much time the processor has spent servicing hardware interrupts
• si: how much time the processor has spent servicing software interrupts
• st: This last number only applies to virtual machines. When Linux is running as a virtual machine on a hypervisor, the st (short for stolen) statistic shows how long the virtual CPU has spent waiting for the hypervisor to service another virtual CPU running on a different virtual machine

This can be toggled with t key which determines how tasks are displayed and can hide the task and cpu information.

e) Memory Usage

This portion consists of two lines which may express values in kibibytes (KiB), mebibytes (MiB) or gibibytes (GiB) depending on the amount of currently installed physical memory.

• Line 1 reflects physical memory, classified as: total, used, free, buffers
• Line 2 reflects virtual memory, classified as: total, used, free, cached

• Physical memory is your RAM, physical pieces of hardware that provide Random Access Memory
• Swap is virtual memory which can be a file or a partition on your hard drive that is essentially used as extra RAM. It is not a separate RAM chip though, it resides on your hard drive.

The memory can be toggled with m key which determines how memory usage is displayed and can hide the memory information.

2. Display Interactive Help menu

It has a powerful interactive mode that is active by default when Top is started. A variety of commands can be used in the form of just letter key presses to manipulate what is being seen. Here we explore these commands further.

First of all, you can press h or ? to display the help menu for interactive commands or a condensed list of commands. We can see the roles of the differents key that we can use in top command execution.

3. Manually Refresh Display

The top command by default refreshes the displayed information after a certain interval (3 seconds). To refresh theses information manually, user can press ENTER or SPACE.

4) Toggle Alternate Display Mode

By default, we have the full screen display mode where the summary and the task data are displayed in a single window. So, at any time, only one field group can be displayed. There is also the Alternate Display Mode, where there can be a maximum of four windows, each displaying a field group. These windows are named Def, Job, Mem and Usr

• Def: sorted by %CPU
  
• Job: sorted by PID
• Mem: sorted by %MEM
• Usr: sorted by User field

The Alternate Display Mode can be entered into using the A display mode toggle command. Each of the 4 field groups has a unique separately configurable summary area and its own configurable task area. Only one of these 4 windows will be the current window. The current window is displayed on the top left corner.

You can switch between 4 windows with a and w keys. a moves to next and w to previous window. With g command, you can enter a number to select the current window.

5) Bold Display

Some important information is shown in bold characters. B command toggles use of bold. This command will influence the use of the bold terminfo capability and alters both the summary area and task area for the current window. When this toggle is 'ON' and top is operating in monochrome mode, the entire display will appear as normal text. Thus, unless the x and/or y toggles are using reverse for emphasis, there will be no visual confirmation that they are even on.

6) Set Display Time interval

d or s keys change the delay between refreshes. Prompt for new delay time, which should be in seconds. Suppressed in secure mode. When d or s is pressed, you will be prompted to enter a value ( in seconds ) which will be set as display interval. If you enter 1 here, top will refresh every second.

7) Toggle Load, Task, Memory Info

l, t and m keys will toggle load average, task/cpu status and mem info respectively as discussed in Uptime and Load Average, CPU State and Memory Usage.

8) Field Management for display

F key used to choose what field you want to display on the output screen. To select a field to display, press SPACE or d key on the name. The fields marked as * are selected. Press q or ESC to quit when you have finished.

< and >
The < command moves the sorted field to the left and > to the right

9) Reverse Sort

By default, the sorting is done in descending order. Pressing R shall reverse the sorting order of the currently sorted column, using this interactive command displays pProcesses consuming the least amount of cpu are shown first.

10) Show the command path

c displays the full command path along with the command line arguments in the COMMAND column.

11) Idle Tasks

i key does not show idle tasks Toggle idle tasks. It displays all tasks or just active tasks. When this toggle is Off, tasks that have not used any CPU since the last update will not be displayed. However, due to the granularity of the %CPU and TIME+  fields,  some process may still be displayed that appear to have used no CPU.

12) Forest View

V key will display the processes in a parent-child hierarchy as below

13) Change color map

Pressing the Z key takes the user to a screen where the display color can be changed for top command. You will be presented with a separate screen. That screen can be used to change the colors in just the current window or in all four windows before returning to the top display. When you issue the Z interactive command, you have 4 upper case letters to select a target for 8 numbers to select a color

The below screen shows full colored top view with all 4 screens on.

14) Toggle Color

z turns on or off the colored display. it switches the current window between your last used color scheme and the older form of black-on-white or white-on- black. This command will alter both the summary area and task area

15) Change highlight for current sort field and running task

x for Column-Highlight toggle changes highlighting for the current sort field. If you forget which field is being sorted, this command can serve as a quick visual reminder, providing the sort field is being displayed. The sort field might not be visible because there is insufficient Screen Width and/or the f interactive command turned it Off

y for Row-Highlight toggle changes highlighting for running tasks. The Use of this provision provides important insight into your system's health. The only costs will be a  few  additional tty escape sequences

Depending on your display settings, You might have to make the output colored in order to notice these highlights.

16) Show the processes of a User

u shows processes for a particular user. You are prompted to enter the username. Blank will show for all users. It displays only processes with a user id or user name matching that given,  matches on effective user

17) Show the number of tasks displayed

n or # set the maximum number of tasks displayed. It prompts to enter the number of tasks to display. The lessor of your number and available screen rows will be used. When used in alternate-display mode, this is the command that gives you precise control over the size of each currently visible task display, except for the very last. It will not affect the last window's size, as all prior task displays will have already been painted.

18) Kill tasks

One of the most important commands of top. k is used to send signals to tasks (Usually kill tasks). You will be prompted for a PID and then the signal to send. Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself. The default signal, as reflected in the prompt, is SIGTERM. However, you can send any signal, via number or name. If you wish to abort the kill process, do one of the following depending on your progress: at the

• at the pid prompt, type an invalid number
• at the signal prompt, type 0 (or any invalid signal)
• at any prompt, type <Esc>

19) Renice a task

The r option is used to change the priority of the process. This operation is also called renice a task to change the scheduling priority. You will be prompted for a PID and then the value to nice it to. Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself. A positive nice value will cause a process to lose priority. Conversely, a negative nice value will cause a process to be viewed more favorably by the kernel.

As a general rule, ordinary users can only increase the nice value and are prevented from lowering it. If you wish to abort the renice process, do one of the following depending on your progress:

• at the pid prompt, type an invalid number
• at the nice prompt, type <Enter> with no input
• at any prompt, type <Esc>

20) Separate CPU state

This command affects how the t command's Cpu States portion is shown. When you see %Cpu(s) in the summary area, the 1 toggle is On and all cpu information is gathered in a single line. Otherwise, each cpu is displayed separately as: `%Cpu0, %Cpu1, ...' up to available screen height.

21) Summarize CPU state

This 2 command toggles between the 1 command cpu summary display (only) or a summary display plus the cpu usage statistics for each NUMA Node.

22) Display top command in batch mode

The -b option starts top command in batch mode. It can be useful when you want to save the output in a file.

# top -b
top - 01:05:36 up 4 days,  2:59,  1 user,  load average: 0.00, 0.00, 0.00
Tasks: 117 total,   1 running, 116 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.6 us,  0.2 sy,  0.0 ni, 99.1 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem :   500096 total,    50244 free,    45732 used,   404120 buff/cache
KiB Swap:        0 total,        0 free,        0 used.   414836 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND
 1373 root      20   0   40388   3672   3160 R  6.2  0.7   0:00.02 top
    1 root      20   0   38052   5600   3488 S  0.0  1.1   0:23.26 systemd
    2 root      20   0       0      0      0 S  0.0  0.0   0:00.01 kthreadd
    3 root      20   0       0      0      0 S  0.0  0.0   0:09.17 ksoftirqd/0
    5 root       0 -20       0      0      0 S  0.0  0.0   0:00.00 kworker/0:0H
    7 root      20   0       0      0      0 S  0.0  0.0   0:27.64 rcu_sched
    8 root      20   0       0      0      0 S  0.0  0.0   0:00.00 rcu_bh
    9 root      rt   0       0      0      0 S  0.0  0.0   0:00.00 migration/0
   10 root      rt   0       0      0      0 S  0.0  0.0   0:04.02 watchdog/0

23) Command/Program-name toggle

As discussed in the above commands, the -c option will toggle from the last remembered state of command/program name display.

24) Set delay interval in command line

-d sets the delay interval for top (in seconds). For example:

$ top -d 1

will start the top command with 1 sec delay interval.

25) idle process toggle in command line

This option sets the top command with last remembered i state reversed.

$ top -i

26) Set number of iterations in command line

With -n option, you can set the number of iterations after which top will end.

$ top -n 3

will exit top automatically after 3 outputs. In the image below, it exited automatically

27) Monitor specific PIDs in command line

You can specify what PIDs you want to monitor with -p option. PID value 0 will be treated as process ID of top command itself.

$ top -p pid_value

28) Display task per username or UID in command line

The process of a particular user can be viewed with these options. Username or UID can be specified to the option. The -p, -u and -U options are mutually exclusive. Only one of the options can be used at a time. You get an error when you try to use any combination of these options:

$ top -u franshesco

29) Make a sort by ... in command line

The -o can be used with top command for filtering. It determines which tasks will be shown in the `current' window. For example, we will sort by %CPU

# top -o %CPU

30) Check top command version

To check the top command version, we use -v option

# top -v
  procps-ng version 3.3.10

Conclusion

Now we can manipulate our processes by top command. We have its powerful and advantages. It is possible to use it in command-line or in interactive mode. Now, we can easily choose how to use it for our needs.