Master Linux top: Real‑Time Process Monitoring and Advanced Usage

top is a dynamic, real‑time process viewer for Linux that shows each process’s resource usage, similar to the Windows Task Manager.

Statistics Section

The first five lines provide overall system statistics.

Line 1 : task queue information, equivalent to the output of uptime (current time, system uptime, number of logged‑in users, load average).

Line 2‑3 : task and CPU details, including total, running, sleeping, stopped, and zombie processes, as well as CPU state percentages (us, sy, ni, id, wa, hi, si, st).

Line 4 : memory usage – total, free, used, and buff/cache.

Line 5 : swap usage – total, free, used, and available memory.

Cpu(s): us   user space CPU percentage
       sy   system space CPU percentage
       ni   nice‑adjusted user processes percentage
       id   idle CPU percentage
       wa   I/O wait percentage
       hi   hardware IRQ percentage
       si   software interrupt percentage
       st   steal time percentage (hypervisor)

Mem: total   total physical memory
     free    free memory
     used    used memory
     buff/cache  memory used for kernel caches

Swap: total   total swap space
      free    free swap space
      used    used swap space
      avail Mem  available swap memory

Process Information Section

Below the statistics, top lists each process with columns such as PID, USER, PR, NI, VIRT, RES, SHR, S, %CPU, %MEM, TIME+, and COMMAND. The full column meanings are:

PID   process ID
PPID  parent process ID
RUSER real user name
UID   user ID of the process owner
USER  username of the process owner
GROUP group name of the process owner
TTY   terminal name ("?" if not started from a terminal)
PR    priority
NI    nice value (negative = higher priority)
P     last CPU used (relevant on multi‑CPU systems)
%CPU  CPU usage since last update
TIME  total CPU time used (seconds)
TIME+ total CPU time used (hundredths of a second)
%MEM  physical memory usage percentage
VIRT  virtual memory size (KB) = SWAP + RES
SWAP  swapped-out virtual memory size (KB)
RES   resident (non‑swapped) memory size (KB) = CODE + DATA
CODE  code segment size (KB)
DATA  data + stack size (KB)
SHR   shared memory size (KB)
FLT   page fault count
DRT   pages written since last update
S     process state (D=uninterruptible sleep, R=running, S=sleeping, T=traced/stopped, Z=zombie)
COMMAND command name or full command line
WCHAN if sleeping, the kernel function name
Flags task flags (see sched.h)

By default, top shows the most important columns; press f to select columns, o to reorder, and F to choose the sort column.

Top Command Options

top [-] [d] [p] [q] [C] [S] [s] [n]

-d <seconds>

: set the delay between screen updates (default 5 s). Example:

top -b -n 2 > /tmp/top.txt

-p <PID>

: monitor only the specified process, e.g., top -p 1. -q: run without any delay; with root privileges, top runs at the highest possible priority. -S: enable cumulative mode. -s: run in safe mode, disabling potentially dangerous interactive commands. -i: hide idle or zombie processes. -c: display the full command line instead of just the command name.

Common Top Operations

Capture output every 2.5 seconds for 5 iterations and save to a file: top -b -d 2.5 -n 5 > performace.txt Note: -b enables batch mode for redirection.

Sort quickly by %CPU, %MEM, or TIME+ using uppercase keys: P – sort by %CPU M – sort by %MEM T – sort by TIME+

Use R for ascending order (default is descending).

Show or hide columns ( f), change column order ( o), and select the sort column ( F).

CPU Steal Time

When running virtual machines (e.g., on Amazon EC2), the %st (steal time) metric indicates how much CPU time the hypervisor has taken away from your VM. A high steal time means the host is overloaded and your VM’s performance will suffer.

In virtualized environments, CPU time is shared among multiple VMs. Even if a VM is allocated a 1/4 CPU share, it can exceed that share if the host has idle cycles, unlike memory which is strictly limited.

Top also shows %id (idle) and %wa (I/O wait). Low %id signals high CPU load, while high %wa indicates the CPU is waiting for I/O operations, such as database reads from disk.

For deeper details on %st, consult additional resources.