How to Use the Top Command in Linux

The top command provides a dynamic, real-time view of the running system. It is used to monitor system processes and resource usage, such as CPU, memory, and swap usage.

General syntax for top command:

$ top [OPTIONS]

1. List all running processes

top

Use the top command to display running tasks, memory, cpu and swap. To close the window, press q

Example:

Runnng the top command in a terminal without any options, here’s what you might get.

top - 15:20:26 up 10 days,  2:30,  1 user,  load average: 0.00, 0.01, 0.05
Tasks: 193 total,   1 running, 192 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.7 us,  0.2 sy,  0.0 ni, 98.9 id,  0.1 wa,  0.0 hi,  0.1 si,  0.0 st
KiB Mem :  8167848 total,  2003084 free,  1652232 used,  4512532 buff/cache
KiB Swap:  2097148 total,  2097148 free,        0 used.  6171720 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND            
 1219 root      20   0  658884  56644  35980 S   6.7  0.7  42:11.77 Xorg               
 2781 user1     20   0  883780  31576  21744 S   6.7  0.4   0:01.01 gnome-terminal-    
    1 root      20   0  225636   9484   6812 S   0.0  0.1   0:07.31 systemd            
    2 root      20   0       0      0      0 S   0.0  0.0   0:00.01 kthreadd           
    4 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 kworker/0:0H       
    6 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 mm_percpu_wq       
    7 root      20   0       0      0      0 S   0.0  0.0   0:00.31 ksoftirqd/0        
    8 root      20   0       0      0      0 I   0.0  0.0   0:02.91 rcu_sched          

The first line provides a summary of the system: current time, uptime, number of users, and load average.

The second line shows the total number of tasks and their states: running, sleeping, stopped, or zombie.

The third line shows CPU usage details: user processes, system processes, idle processes, etc.

The fourth and fifth lines show memory usage: total, free, used, and buffer/cache memory.

The rest of the lines list out all the processes running on the system. Each line represents a process with details like PID, USER, CPU usage, Memory usage, and the command used to start the process.

2. Display processes of a specific user

top -u [user]

The -u option allows you to display all information about the running processes of a specific user.

Example:

Displaying running processes of the root user.

top - 12:34:56 up 10 days,  2:30,  2 users,  load average: 0.00, 0.01, 0.05
Tasks: 100 total,   1 running,  99 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.3 us,  0.1 sy,  0.0 ni, 99.5 id,  0.0 wa,  0.0 hi,  0.1 si,  0.0 st
MiB Mem :   7976.1 total,   1694.7 free,   1263.5 used,   5017.8 buff/cache
MiB Swap:   1024.0 total,   1024.0 free,      0.0 used.   6412.1 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
    1 root      20   0  225492   9484   6812 S   0.0   0.1   0:06.37 systemd
    2 root      20   0       0      0      0 S   0.0   0.0   0:00.01 kthreadd
    3 root      20   0       0      0      0 S   0.0   0.0   0:00.36 ksoftirqd/0
    5 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/0:0H
    7 root      20   0       0      0      0 I   0.0   0.0   0:01.31 rcu_sched
  ...

In this example, you can see that the top -u root command is showing only the processes owned by the root user. The output includes information about each process, such as the process ID (PID), priority (PR), nice value (NI), virtual memory size (VIRT), resident memory size (RES), shared memory size (SHR), CPU usage (%CPU), memory usage (%MEM), and the command used to start the process (COMMAND).

3. Enabling Batch Mode

top -b

The top -b command is used to run top in batch mode. This is particularly useful when you want to redirect the output of top to a file or another command. In batch mode, top will not accept input and runs until the iterations limit you’ve set, or until killed.

Example:

In this example, -n 1 tells top to only run once, instead of continuously updating. The output is then redirected into top-output.txt.

When you open the top-output.txt file, you might see output similar to this:

top - 18:25:01 up 10 days,  5:45,  1 user,  load average: 0.00, 0.01, 0.05
Tasks: 162 total,   1 running, 161 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.7 us,  0.3 sy,  0.0 ni, 98.9 id,  0.1 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem :  8167848 total,  1785084 free,  1583456 used,  4799308 buff/cache
KiB Swap:  2097148 total,  2097148 free,        0 used.  6250480 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
    1 root      20   0  225492   9484   6812 S   0.0  0.1   0:09.07 systemd
    2 root      20   0       0      0      0 S   0.0  0.0   0:00.01 kthreadd
    3 root      20   0       0      0      0 S   0.0  0.0   0:00.55 ksoftirqd/0
    5 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 kworker/0:0H
    7 root      20   0       0      0      0 S   0.0  0.0   0:07.28 rcu_sched

4. Start from the same state

top -c

top -c displays the currently active processes along with additional information, including the full command line used to start each process. This can be useful for seeing exactly what parameters were passed to a process.

Example:

Here’s an example output of the top -c command:

top - 12:34:56 up 10 days,  2:03,  2 users,  load average: 0.00, 0.01, 0.05
Tasks: 100 total,   1 running,  99 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.3 us,  0.1 sy,  0.0 ni, 99.6 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem :  2040204 total,   987204 free,   105204 used,   948796 buff/cache
KiB Swap:  1048572 total,  1048572 free,        0 used.  1830204 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
    1 root      20   0  159444   6604   3904 S   0.0  0.3   0:06.35 /sbin/init splash
    2 root      20   0       0      0      0 S   0.0  0.0   0:00.02 [kthreadd]
    3 root      20   0       0      0      0 S   0.0  0.0   0:00.85 [ksoftirqd/0]
    5 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 [kworker/0:0H]
    7 root      20   0       0      0      0 S   0.0  0.0   0:03.78 [rcu_sched]
  123 root      20   0  278532  37888  26976 S   0.0  1.9   0:03.45 /usr/bin/dockerd -H fd://
  456 www-data  20   0  161916   6412   2680 S   0.0  0.3   0:00.01 /usr/sbin/apache2 -k start

The first few lines provide a summary of the system, including the current time, how long the system has been running, the number of users, the load average, and memory usage.

Each line after that represents a single process, with various pieces of information about each process. This includes the process ID (PID), the user who owns the process, the priority (PR) and nice values (NI), memory usage (VIRT, RES, SHR), current status (S), CPU usage (%CPU), memory usage (%MEM), time the process has been running (TIME+), and the full command line (COMMAND).

The -c option shows the full command line used to start each process. For example, for PID 1, the command is /sbin/init splash. For PID 123, the command is /usr/bin/dockerd -H fd://. This can be useful for seeing exactly what parameters were passed to a process.

5. Enable Secure Mode

top -s

The -s option is used for secure mode operation. In secure mode, some potentially harmful interactive commands are disabled. This is particularly useful when top is run by system administrators in an environment where they want to limit what users can do.

Example:

Here’s an example of how you might use the -s option in this context:

top -s 5

This command will start top and refresh the display every 0.5 seconds.

6. Set delay time of screen updates

top -d [seconds]

The -d option is used to specify the delay time between screen updates, or in other words, the refresh rate. By default, top updates every 3.0 seconds, but with the -d option, you can set this to any desired interval.

Example:

Specifying the number 20 after the -d option to update the output every 20 seconds.

top -d 20

7. Set the number of iterations

top -n [number]

top -n updates the top command display n times and then exit. This can be useful if you want to take a quick snapshot of the system at regular intervals.

More Linux commands: