Inspecting processes with top

Last updated: 31 May 2021

The top utility is useful if you want to monitor system performance over time. Whereas ps gives you a static overview of processes – it takes a single snapshot – top refreshes its output every couple of seconds. This makes it easy to see which processes are consistently using the most resources.

The output can be customised and there are various options you can use when you launch top. One useful option is -U, which displays only processes for a user. For instance, top -U example shows all processes for the user example. Another thing to note is that you quit top by typing q.

Summary display

The output of top has two sections:

• The first five lines show information about the system. This is the summary display.
• The remainder of the output shows information about processes. This is the fields display.

Uptime and load averages

The first line of the summary display looks like this:

top - 12:29:07 up 41 days, 15:28,  1 user,  load average: 0.68, 1.16, 1.50

This shows the uptime (how long the system has been running); the number of logged in users and the load averages. Whether or not the load averages are too high depends on the number of CPU cores the system has. On a system with one CPU core the load averages should be below 1; on a system with 2 cores any load below 2 is fine and so forth.

There are two ways to quickly check the number of cores:

• Hitting the 1 key in top shows CPU usage information for each CPU. In a system with just one core there is just one line, and a system with 16 cores will show 16 lines. So, counting the number of lines tells you the number of cores.
• Alternatively, the nproc command prints the number of CPU cores.

Tasks

The second line looks like this:

Tasks: 235 total,   3 running, 232 sleeping,   0 stopped,   0 zombie

There is nothing much of interest here: it just shows the total number of processes and their state (running, sleeping, stopped or zombie).

CPU usage

The third line of the output is a summary of the CPU usage:

%Cpu(s):  4.2 us,  0.8 sy,  0.0 ni, 94.8 id,  0.2 wa,  0.0 hi,  0.1 si,  0.0 st

This is quite a detailed breakdown, and some of the information can be useful when debugging an issues:

• us is CPU time used by users. If this value is very high then the CPU usage is caused by user processes rather than system processes.
• sy is CPU time used by the kernel.
• ni is the percentage of processes running at a lower priority (nice processes).
• id is the percentage of idleness. A system that is under a high load has a low id value, and vice versa.
• wa is the percentage of jobs waiting for I/O.
• hi and si are the percentages of hardware and software interrupts.
• st is steal time and generally used with virtual machines (which have some of its idle CPU taken for other uses).

Memory usage

The last two lines of the summary display provide lots of information about the memory and swap usage. This information is very similar to the stats shown by free.

KiB Mem :  8009032 total,  1552156 free,  2593016 used,  3863860 buff/cache
KiB Swap:        0 total,        0 free,        0 used.  4561728 avail Mem

The first line features the usual suspects: total, free, used and buff/cache. It is important to understand that the amount of memory shown in the used column is actually available – the memory is reserved for running processes but it can be freed by the kernel at any time. The amount of free memory is typically low, because the kernel takes the view that unused memory is wasted memory. The best indication of the actual amount of available memory is the figure shown in the avail Mem field on the second (swap memory) line – it is the amount of memory that can be made available without swapping.

By default the memory stats are shown in kibibytes. You can use the E key to cycle through the memory scale (kibibytes, mebibytes, gibibytes etc.). So, if converting kibibytes to mebibytes isn’t your hobby, use the E key to get top to use more digestible numbers.

Fields display

The remainder of the top output displays information about processes:

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
 8327 mysql     20   0 2216060  78164   1388 S  87.5  4.2   8355:29 mysqld
30654 example   20   0  578896  21616   9524 R  43.8  1.1   0:03.80 php-fpm
31009 example   20   0  512528  24568   6420 R  43.8  1.3   0:00.12 php-fpm
30914 example   20   0  587232  29700   9368 S   6.2  1.6   0:02.01 php-fpm
31010 root      20   0  160324   2300   1496 R   6.2  0.1   0:00.01 top
    1 root      20   0  191288   2620   1324 S   0.0  0.1  10:53.37 systemd
...

By default, the output is sorted by CPU usage. Enter the M key to sort the output by memory usage instead, and use the P key to sort the output by CPU usage again. Another useful shortcut is c. This option adds command line arguments to the command column.

Field columns

Most of the columns shown in the field display are self-explanatory:

• PID is the process ID.
• USER is the user who started the process.
• PR and NI are the process priority and niceness. A lower NI value means that the process has a higher priority.
• VIRT, RES, SHR AND %MEM are all related to memory usage. The main columns to look at are RES and %MEM. For a more detailed explanation, please see my article about memory data in free and top.
• S is the state of the process.
• TIME+ is the amount of CPU time a process has used.
• COMMAND is the name of process.

Killing a process

If a process is grinding the system to a halt then you may have to kill it. To do so, enter k. top will ask you for the PID and the signal you want to send the process. It is best to first try the SIGTERM signal (15). If that doesn’t work and you absolute need to kill the process then you can use SIGKILL (9) instead. This should only be a last resort, as the process is killed on the spot. This is particularly dangerous with database processes.

List processes for a user

The u shortcut limits the output to processes for a certain user. Simply enter the username of the user you are interested in. To list all processes again, use u and hit enter (without specifying a username).