Master Linux Performance Monitoring with the top Command: A Complete Guide

Overview

top

is a dynamic, real‑time process viewer for Linux that continuously displays system‑wide statistics and per‑process resource usage, similar to the Windows Task Manager.

Statistics Area

The first five lines show overall system metrics:

Current time – e.g., 07:25:19 Uptime – how long the system has been running.

Users – number of logged‑in users.

Load average – 1‑, 5‑, and 15‑minute averages of runnable processes.

Subsequent lines provide CPU and memory breakdowns.

Cpu(s): us   – user‑space CPU percentage</code>
<code>sy   – kernel‑space CPU percentage</code>
<code>ni   – nice‑adjusted user processes CPU percentage</code>
<code>id   – idle CPU percentage</code>
<code>wa   – I/O wait CPU percentage</code>
<code>hi   – hardware interrupt (IRQ) CPU percentage</code>
<code>si   – software interrupt CPU percentage</code>
<code>st   – steal time (virtual CPU waiting for real CPU) percentage</code>
<code>Mem: total   – total physical memory</code>
<code>free   – free memory</code>
<code>used   – used memory</code>
<code>buff/cache – memory used for kernel buffers/cache</code>
<code>Swap: total   – total swap space</code>
<code>free   – free swap</code>
<code>used   – used swap</code>
<code>avail Mem – available memory (including cache)

Process Information Area

Each row below the statistics represents a process. Important columns include:

PID      – process ID</code>
<code>PPID     – parent process ID</code>
<code>USER     – owner username</code>
<code>PR       – priority</code>
<code>NI       – nice value (negative = higher priority)</code>
<code>VIRT     – virtual memory size (KB)</code>
<code>RES      – resident (non‑swapped) memory (KB)</code>
<code>SHR      – shared memory (KB)</code>
<code>%CPU     – CPU usage percentage since last update</code>
<code>%MEM     – physical memory usage percentage</code>
<code>TIME+    – total CPU time consumed (hundredths of a second)</code>
<code>COMMAND  – command name or full command line</code>
<code>WCHAN    – kernel function where the process is sleeping</code>
<code>Flags    – task flags (see <code>sched.h</code>)

By default top shows a subset of columns (PID, USER, PR, NI, VIRT, RES, SHR, %CPU, %MEM, TIME+, COMMAND). Press f to toggle column visibility, o to reorder columns, and F to select the sort column.

Command‑Line Options

top -b -d 2.5 -n 5 > performance.txt</code>
<code>-d <interval>   Set refresh interval in seconds (default 5 s)</code>
<code>-p <pid>        Show only the specified PID</code>
<code>-q              Run with no delay (high priority if run as root)</code>
<code>-S              Enable cumulative mode</code>
<code>-s              Secure mode (disables dangerous interactive commands)</code>
<code>-i              Hide idle and zombie processes</code>
<code>-c              Show full command line instead of just the program name</code>
<code>-n <iterations> Number of refresh iterations (e.g., <code>-n 2</code> for two snapshots)

Common Interactive Operations

Sort by %CPU, %MEM, or TIME+ using capital keys P, M, T.

Reverse sort order (ascending) with capital R.

Show/hide columns with f, change column order with o, and select the sort column with F.

CPU Steal Time (%st)

In virtualized environments (e.g., Amazon EC2), the %st field indicates the proportion of CPU cycles that the hypervisor has taken away from the guest for other VMs. A high %st value signals severe CPU contention and degraded performance.

Typical top output also shows %id (idle) and %wa (I/O wait). Low %id means the CPU is heavily loaded, while high %wa indicates the CPU is waiting for I/O operations such as disk reads.