top Process Monitor

top cheatsheet — real-time process monitor. Press M to sort by memory, P by CPU, k to kill. top -b -n 1 for batch output. See load average, CPU, memory at a glance.

5 min read

What it is

top is a real-time interactive process monitor that displays system resource usage and running processes, helping you identify resource hogs and troubleshoot performance issues.

Installation

top is typically pre-installed on most Linux and macOS systems. If for some reason it’s not:

Linux (Debian/Ubuntu):

sudo apt update
sudo apt install procps

Linux (Fedora/CentOS/RHEL):

sudo yum install procps-ng
# or
sudo dnf install procps-ng

macOS: top is built-in.

Windows: top is not natively available on Windows. For similar functionality, consider using PowerShell’s Get-Process cmdlet or a third-party tool like Process Explorer.

Core Concepts

  • Tasks/Processes: Individual running programs or services.
  • CPU Usage: The percentage of processor time a process is consuming.
  • Memory Usage (RES/VIRT):
    • RES (Resident Memory): The amount of physical RAM a process is currently using.
    • VIRT (Virtual Memory): The total amount of virtual address space used by a process, including swapped-out memory and shared libraries.
  • Load Average: The average number of processes waiting to run over the last 1, 5, and 15 minutes. High load averages indicate a system is under heavy demand.
  • States: Processes can be in various states:
    • R (Running or runnable)
    • S (Sleeping, waiting for an event)
    • D (Uninterruptible sleep, often waiting for I/O)
    • Z (Zombie, process terminated but not reaped by parent)
    • T (Stopped or traced)

Commands / Usage

Running top

top

Starts top in interactive mode, showing processes sorted by CPU usage by default.

Basic Interaction (while top is running)

  • q: Quit top.
  • h or ?: Display help screen.
  • k: Kill a process. Prompts for PID and signal (default is 15/TERM).
  • r: Renice a process. Prompts for PID and nice value (lower is higher priority).
  • f: Fields management. Allows selecting which columns to display.
  • o: Order/Sort. Prompts for a sort field.
  • M: Sort by memory usage.
  • P: Sort by CPU usage (default).
  • T: Sort by time/cumulative utilization.
  • 1: Toggle CPU summary display (per-core vs. total).
  • m: Toggle memory usage summary display.
  • t: Toggle task/CPU states summary display.
  • l: Toggle load average and uptime summary display.
  • c: Toggle command name/full command line display.
  • i: Toggle display of idle processes.
  • s: Change update interval. Prompts for seconds.
  • u: Filter by user. Prompts for username.
  • W: Write current configuration to ~/.toprc.

Command-line Options (running top with arguments)

top -d 2

Run top with an update interval of 2 seconds.

top -p 1234

Monitor only the process with PID 1234.

top -u www-data

Monitor only processes owned by the www-data user.

top -n 5

Run top for 5 iterations and then exit. Useful for scripting.

top -b -n 1

Run top in batch mode (non-interactive) for one iteration. Useful for capturing output in scripts.

top -H

Show individual threads (if supported by the system).

Fields Explained

  • PID: Process ID.
  • USER: Owner of the process.
  • PR: Priority of the process.
  • NI: Nice value (lower means higher priority).
  • VIRT: Virtual memory size.
  • RES: Resident memory size.
  • SHR: Shared memory size.
  • S: Process status (R, S, D, Z, T).
  • %CPU: CPU usage percentage.
  • %MEM: Memory usage percentage.
  • TIME+: Cumulative CPU time.
  • COMMAND: Command name or full command line.

Common Patterns

Running top non-interactively for a single snapshot:

top -b -n 1

This is useful for piping the output to other commands or for logging.

Finding the top 5 memory-consuming processes:

top -b -n 1 | head -n 12 | tail -n 5

(Assumes the header takes up 7 lines, adjust head value if needed).

Finding the top 5 CPU-consuming processes:

top -b -n 1 | grep -E '^[ ]*[0-9]+' | sort -rnk 9 | head -n 5

This filters for lines starting with a PID, sorts numerically in reverse on the 9th column (%CPU), and takes the top 5.

Monitoring a specific process by PID:

top -p 1001

Keeps top focused on a single process.

Monitoring processes for a specific user:

top -u nginx

Useful for checking resource usage of a particular service.

Sending a signal to a process:

# First, find the PID using top
top
# Note the PID (e.g., 5678)
# Then, kill it gracefully
kill -15 5678
# If it doesn't stop, force kill
kill -9 5678

Or directly within top using the k command.

Saving current top configuration:

top -W

This saves the current sort order, visible columns, and other settings to ~/.toprc so they are applied the next time you run top.

Gotchas

  • %CPU Interpretation: %CPU is the percentage of a single CPU core. On multi-core systems, a process using 100% of one core will show 100%, not 25% on a quad-core system. Use 1 to toggle per-core view for better understanding.
  • Load Average: A load average above the number of CPU cores indicates the system is likely overloaded.
  • Zombie Processes (Z state): These are processes that have finished execution but their parent process hasn’t yet acknowledged their termination. They consume minimal resources but can indicate a problem with the parent process. Killing them directly usually doesn’t work; the parent needs to be addressed.
  • Uninterruptible Sleep (D state): Often caused by hardware issues or driver problems, especially during disk I/O. Processes in this state cannot be killed easily.
  • Batch Mode (-b): When using batch mode, top won’t update automatically. You typically use -n 1 to get a single snapshot. Output is designed for parsing.
  • ~/.toprc: If top behaves unexpectedly, check your ~/.toprc file for custom configurations that might be causing issues. You can delete it to reset to defaults.
  • Permissions: You need appropriate permissions to view all processes and to kill/renice processes. Use sudo if necessary, but be cautious.