System Process Monitoring with top Command
Table of Contents
1. [Introduction](#introduction) 2. [Basic Syntax and Usage](#basic-syntax-and-usage) 3. [Understanding the Display](#understanding-the-display) 4. [Interactive Commands](#interactive-commands) 5. [Command Line Options](#command-line-options) 6. [Process Information Fields](#process-information-fields) 7. [Sorting and Filtering](#sorting-and-filtering) 8. [Configuration and Customization](#configuration-and-customization) 9. [Advanced Usage Examples](#advanced-usage-examples) 10. [Alternative Tools](#alternative-tools) 11. [Troubleshooting Common Issues](#troubleshooting-common-issues) 12. [Best Practices](#best-practices)Introduction
The top command is one of the most essential system administration tools in Unix-like operating systems. It provides a dynamic, real-time view of running system processes, displaying information about CPU usage, memory consumption, system load, and individual process statistics. Unlike static commands such as ps, top continuously updates its display, making it invaluable for monitoring system performance and identifying resource-intensive processes.
The command has been a cornerstone of system monitoring since the early days of Unix systems and remains relevant today for both system administrators and developers who need to understand system behavior and performance characteristics.
Basic Syntax and Usage
Command Syntax
`bash
top [options]
`
Starting top
The simplest way to start top is by typing the command without any arguments:
`bash
top
`
This launches the interactive interface with default settings, displaying processes sorted by CPU usage in descending order.
Basic Navigation
Once top is running, you can interact with it using various keyboard commands:
`bash
q # Quit top
h or ? # Display help screen
Space # Refresh display immediately
k # Kill a process
r # Renice a process
`
Understanding the Display
The top display consists of two main sections: the system summary area at the top and the process list below it.
System Summary Area
The summary area provides an overview of system-wide statistics:
#### Line 1: System Time and Load Average
`
top - 14:30:25 up 5 days, 12:34, 3 users, load average: 0.45, 0.52, 0.48
`
| Component | Description |
|-----------|-------------|
| 14:30:25 | Current system time |
| up 5 days, 12:34 | System uptime |
| 3 users | Number of logged-in users |
| load average: 0.45, 0.52, 0.48 | 1, 5, and 15-minute load averages |
#### Line 2: Task Summary
`
Tasks: 247 total, 1 running, 246 sleeping, 0 stopped, 0 zombie
`
| Field | Description |
|-------|-------------|
| total | Total number of processes |
| running | Processes currently using CPU |
| sleeping | Processes waiting for resources |
| stopped | Processes suspended by signals |
| zombie | Terminated processes awaiting cleanup |
#### Line 3: CPU Usage
`
%Cpu(s): 2.3 us, 1.2 sy, 0.0 ni, 96.2 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st
`
| Field | Description |
|-------|-------------|
| us | User space CPU usage percentage |
| sy | System/kernel space CPU usage |
| ni | Nice (low priority) processes CPU usage |
| id | Idle CPU percentage |
| wa | I/O wait time percentage |
| hi | Hardware interrupt handling time |
| si | Software interrupt handling time |
| st | Steal time (virtualized environments) |
#### Lines 4-5: Memory Information
`
KiB Mem : 8174332 total, 1247856 free, 3892540 used, 3033936 buff/cache
KiB Swap: 2097148 total, 2097148 free, 0 used. 3847252 avail Mem
`
| Field | Description |
|-------|-------------|
| total | Total physical memory |
| free | Unused memory |
| used | Used memory |
| buff/cache | Memory used for buffers and cache |
| avail Mem | Available memory for new processes |
Process List
The process list displays detailed information about individual processes:
`
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1234 john 20 0 162840 12456 8932 S 5.2 0.2 0:12.34 firefox
5678 root 20 0 45632 3244 2156 R 2.1 0.0 0:03.45 systemd
`
Interactive Commands
Process Control Commands
| Command | Description | Usage Example |
|---------|-------------|---------------|
| k | Kill a process | Press k, enter PID, then signal number |
| r | Renice a process | Press r, enter PID, then new nice value |
| u | Show processes for specific user | Press u, enter username |
| c | Toggle command line display | Shows full command path |
| V | Forest view (process tree) | Displays parent-child relationships |
Display Control Commands
| Command | Description | Effect |
|---------|-------------|--------|
| 1 | Toggle CPU core display | Shows individual CPU cores |
| t | Toggle task/CPU summary | Cycles through display modes |
| m | Toggle memory display | Changes memory information format |
| l | Toggle load average line | Shows/hides load information |
| I | Toggle idle processes | Filters out idle processes |
Sorting Commands
| Command | Description | Sort Field |
|---------|-------------|------------|
| P | Sort by CPU usage | %CPU (default) |
| M | Sort by memory usage | %MEM |
| T | Sort by time/cumulative time | TIME+ |
| N | Sort by process ID | PID |
| < | Move sort column left | Previous field |
| > | Move sort column right | Next field |
| R | Reverse sort order | Toggle ascending/descending |
Command Line Options
Display Options
| Option | Description | Example |
|--------|-------------|---------|
| -d delay | Set refresh interval | top -d 2 (2-second updates) |
| -n iterations | Number of updates before exit | top -n 5 (exit after 5 updates) |
| -b | Batch mode (non-interactive) | top -b -n 1 > output.txt |
| -q | Quiet mode (faster updates) | top -q |
| -S | Cumulative time mode | top -S |
Process Selection Options
| Option | Description | Example |
|--------|-------------|---------|
| -p pid | Monitor specific process | top -p 1234 |
| -u user | Show processes for user | top -u john |
| -U user | Show processes by effective user | top -U root |
Output Format Options
| Option | Description | Example |
|--------|-------------|---------|
| -c | Show full command lines | top -c |
| -H | Show threads instead of processes | top -H |
| -i | Ignore idle processes | top -i |
| -s | Secure mode (disable some commands) | top -s |
Process Information Fields
Standard Fields
| Field | Description | Units | Notes |
|-------|-------------|-------|-------|
| PID | Process ID | Number | Unique process identifier |
| USER | Process owner | Username | Effective user |
| PR | Priority | Number | Kernel scheduling priority |
| NI | Nice value | -20 to 19 | User-space priority |
| VIRT | Virtual memory | KB | Total virtual memory used |
| RES | Resident memory | KB | Physical memory currently used |
| SHR | Shared memory | KB | Shared memory with other processes |
| S | Process state | Character | R=Running, S=Sleeping, etc. |
| %CPU | CPU usage | Percentage | CPU time used since last update |
| %MEM | Memory usage | Percentage | Physical memory percentage |
| TIME+ | CPU time | Time format | Total CPU time used |
| COMMAND | Command name | String | Process name or command line |
Process States
| State | Character | Description | |-------|-----------|-------------| | Running | R | Currently executing or runnable | | Sleeping | S | Interruptible sleep (waiting for event) | | Disk Sleep | D | Uninterruptible sleep (usually I/O) | | Stopped | T | Stopped by job control signal | | Zombie | Z | Terminated but not reaped by parent | | Dead | X | Process should never be seen |
Additional Fields (Togglable)
| Field | Description | Toggle Key |
|-------|-------------|------------|
| PPID | Parent process ID | Available in field selection |
| UID | User ID number | Available in field selection |
| GID | Group ID number | Available in field selection |
| TTY | Controlling terminal | Available in field selection |
| WCHAN | Kernel wait channel | Available in field selection |
Sorting and Filtering
Sorting Examples
`bash
Sort by memory usage
top -o %MEMSort by CPU usage (default)
top -o %CPUSort by process ID
top -o PIDReverse sort order
top -o -%CPUFiltering Examples
`bash
Show only processes for user 'john'
top -u johnShow specific process
top -p 1234Show multiple specific processes
top -p 1234,5678,9012Ignore idle processes
top -iAdvanced Filtering
Within the interactive interface, you can use the o command to add custom filters:
`bash
Press 'o' then enter filter expression
COMMAND=firefox # Show only firefox processes %CPU>5.0 # Show processes using more than 5% CPU USER=root # Show only root processesConfiguration and Customization
Configuration File
The top command stores its configuration in ~/.toprc. This file contains display preferences and can be customized.
Field Selection
Press f to enter field selection mode, where you can:
- Toggle field visibility with letter keys
- Move fields with arrow keys
- Set sort field with s
- Quit field selection with q
Color Customization
Press z to toggle color mode, then Z to customize colors:
| Element | Description | |---------|-------------| | Summary area | System information at top | | Message/prompt line | Interactive prompts | | Column headers | Process list headers | | Running tasks | Currently executing processes | | Selected process | Highlighted process |
Window Management
top supports multiple windows for different views:
| Command | Description |
|---------|-------------|
| a | Toggle alternative display |
| w | Write current configuration |
| A | Cycle through windows |
| g | Choose window by number |
Advanced Usage Examples
Example 1: Monitoring Specific Application
`bash
Monitor all Firefox processes
top -c -p $(pgrep firefox | tr '\n' ',' | sed 's/,$//')Alternative using process name filtering
top -c | grep firefoxExample 2: Batch Mode for Logging
`bash
Capture system state every 5 seconds for 1 hour
top -b -d 5 -n 720 > system_monitor.logMonitor specific user's processes
top -b -u apache -n 10 > apache_processes.logExample 3: Memory Usage Analysis
`bash
Sort by memory usage and show full command lines
top -c -o %MEMShow only processes using more than 1% memory
top -c -o %MEM | awk 'NR<=7 || $9>1.0'Example 4: CPU Usage Monitoring
`bash
Show individual CPU cores
top -1Monitor high CPU usage processes
top -c -o %CPU -d 1Example 5: System Load Monitoring
`bash
Minimal display focusing on load
top -d 2 -n 0 | grep "load average"Combined with other tools for alerting
while true; do load=$(top -bn1 | grep "load average" | awk '{print $12}' | cut -d, -f1) if (( $(echo "$load > 2.0" | bc -l) )); then echo "High load detected: $load" fi sleep 30 doneAlternative Tools
htop
An enhanced version of top with better user interface:
`bash
Install htop
sudo apt install htop # Debian/Ubuntu sudo yum install htop # RHEL/CentOSBasic usage
htopatop
Advanced system and process monitor:
`bash
Install atop
sudo apt install atopUsage with specific interval
atop 2iotop
I/O monitoring tool:
`bash
Monitor I/O usage
sudo iotopShow only active processes
sudo iotop -oComparison Table
| Tool | Strengths | Best Use Case |
|------|-----------|---------------|
| top | Universal availability, lightweight | Basic monitoring, scripts |
| htop | Better interface, mouse support | Interactive monitoring |
| atop | Detailed I/O statistics | Performance analysis |
| iotop | I/O focus | Disk bottleneck diagnosis |
Troubleshooting Common Issues
High Load Average
When load average is consistently high:
`bash
Check for CPU-bound processes
top -o %CPUCheck for I/O wait
top -d 1 # Look at 'wa' in CPU lineIdentify I/O-heavy processes
sudo iotop -oMemory Issues
For memory-related problems:
`bash
Sort by memory usage
top -o %MEMCheck for memory leaks
watch -n 1 'top -b -n 1 -o %MEM | head -20'Monitor swap usage
top # Look at swap line in summaryProcess Identification
Finding problematic processes:
`bash
Find processes by name pattern
top -c | grep -i patternMonitor specific user
top -u usernameTrack process tree
top -c -p parent_pidPerformance Optimization
Using top for performance tuning:
`bash
Identify CPU hogs
top -o %CPU -d 1Monitor after changes
top -b -d 5 -n 12 > before_optimization.logMake changes
top -b -d 5 -n 12 > after_optimization.logBest Practices
Monitoring Guidelines
1. Regular Monitoring: Check system status regularly during peak hours 2. Baseline Establishment: Know normal system behavior patterns 3. Alert Thresholds: Set mental or automated thresholds for intervention 4. Documentation: Keep logs of unusual behavior for trend analysis
Efficient Usage
`bash
Use appropriate refresh intervals
top -d 5 # For general monitoring top -d 1 # For troubleshooting top -d 10 # For long-term observationCombine with other tools
top -b -n 1 | grep "load average" # Quick load check ps aux | sort -k 3 -nr | head -10 # Top CPU processes snapshotSecurity Considerations
`bash
Run in secure mode to prevent process manipulation
top -sMonitor security-related processes
top -u root -c # Monitor root processes top | grep -E "(ssh|login|su)" # Monitor login processesAutomation and Scripting
`bash
Create monitoring script
#!/bin/bash while true; do timestamp=$(date '+%Y-%m-%d %H:%M:%S') load=$(top -bn1 | grep "load average" | awk '{print $10,$11,$12}') echo "$timestamp Load: $load" >> system_load.log sleep 300 # 5-minute intervals doneProcess monitoring function
monitor_process() { local process_name=$1 local duration=${2:-60} echo "Monitoring $process_name for $duration seconds..." timeout $duration top -b -d 1 -c | grep -i "$process_name" | \ while read line; do echo "$(date): $line" done }Resource Management
Understanding when and how to intervene:
`bash
Kill high-CPU process (use with caution)
top # Note the PID kill -TERM pid # Graceful termination kill -KILL pid # Force termination if neededAdjust process priority
renice +10 pid # Lower priority renice -5 pid # Higher priority (requires privileges)The top command remains an indispensable tool for system administrators and developers. Its real-time monitoring capabilities, combined with extensive customization options and interactive features, make it essential for understanding system performance, troubleshooting issues, and maintaining optimal system operation. Whether used for quick system checks or detailed performance analysis, mastering top is crucial for effective system administration.