The Unix top command is useful for monitoring systems continuously for processes that take more system resources like the CPU time and the memory. top periodically updates the display showing the high resource consuming processes at the top. top is an excellent aid in checking a system. If your Linux or Unix system is giving a slow response time, just run top and look for statistics like - load average, CPU utilization, memory and swap usage and the top CPU and memory intensive processes. The chances are that you will get a fair idea of what is happening in the system. The top command can be started simply by giving the command,
The top command output is a screen, like
top - 07:16:19 up 69 days, 1:37, 1 user, load average: 0.02, 0.02, 0.05 Tasks: 86 total, 1 running, 85 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3%us, 0.0%sy, 0.0%ni, 99.2%id, 0.1%wa, 0.0%hi, 0.0%si, 0.4%st Mem: 1705192k total, 812548k used, 892644k free, 155496k buffers Swap: 917500k total, 0k used, 917500k free, 404560k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 3 root 20 0 0 0 0 S 2.0 0.0 0:32.60 ksoftirqd/0 1 root 20 0 2924 1748 1256 S 0.0 0.1 0:01.01 init 2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd 4 root 20 0 0 0 0 S 0.0 0.0 1:23.51 kworker/0:0 5 root 20 0 0 0 0 S 0.0 0.0 0:00.42 kworker/u:0 6 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0 7 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 cpuset 8 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 khelper 9 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 netns 10 root 20 0 0 0 0 S 0.0 0.0 0:00.00 xenwatch 11 root 20 0 0 0 0 S 0.0 0.0 0:00.29 xenbus 12 root 20 0 0 0 0 S 0.0 0.0 0:12.09 sync_supers 13 root 20 0 0 0 0 S 0.0 0.0 0:00.46 bdi-default 14 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kintegrityd 15 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kblockd 16 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 ata_sff 17 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khubd 18 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 md ....
top command output
There are four areas in the top command output, which are the Summary Area, Message/Prompt Line, Columns Header and Task Area. The first five lines make the Summary Area. The Summary Area gives the system status in a summarized form. The first line gives the command name, current system time, system uptime, number of current users and the load average for the last one minute, five minutes and fifteen minutes respectively. The next line gives a count of total number of processes in the system and also the state-wise count of these processes is also given. The next line gives CPU utilization between now and the time of last refresh. In the case of the above output, the breakup of CPU time as a percentage since last refresh is that 0.3% of CPU time has been spent in executing user processes that are not nice'd, 0.0% time has been spent in running the kernel and its processes, 0.0% time has been spent on user processes that have been nice'd, 99.2% of the time CPU(s) is/are idle, 0.1% of the time CPU(s) is/are waiting for I/O to complete, 0.0% of the time is spent in servicing hardware interrupts, 0.0% of the time is spent in servicing software interrupts, and, finally, 0.4% is the steal time which has been
stolen from this virtual machine by the hypervisor for other tasks, like running another virtual machine. The next two lines give details about the memory usage in the system. In this case, the total physical memory is 1,705,192 kilobytes, out of which 812,548k is used and 892,644k is free. 155,496k of memory is used for block I/O buffers (Buffers). In the next line under Swap, there is the important statistic at the end, Cached, which is 404,560k and is most of the Linux page cache. (Page cache is Cached and SwapCached memories put together; SwapCache is not given in the above output). Since Cached and Buffers together shrink to cater to the dynamic memory demands from processes, the actual free memory is free memory reported plus Cached plus Buffers, which, in this case, is 1,452,700k. Also given in the last line is the total swap space, which, in this case, is 917500k. In this case, the swap memory has not been used at all and it is all free.
The next area is the Message/Prompt Line, which is a single line after the Summary Area. The cursor is normally at the beginning of this line, prompting entry of user sub-commands for top. The error messages are also displayed here. Next, is the Columns Header area, displaying column headings. After that, we have the Task Area, where the details of the processes are displayed, one process per line. The process details displayed are, the process id (PID), effective user name of the owner (USER), priority (PR), nice value (NI), total amount of virtual memory used (VIRT), resident size - the non-swapped physical memory used (RES), shared memory - memory that could potentially be shared (SHR), status (S), percentage of the CPU time (%CPU) used since the last refresh, physical memory used (%MEM) as a percentage of available physical memory, total CPU time (TIME+) used since the start given in the grainuality of hundredths of a second and the command (COMMAND) name. The process status values are running (R), sleeping (S), uninterruptible sleep (D), traced or stopped (T) and zombie (Z). Processes shown as running as actually
ready to run, being on the run queue of the system. The processes are listed in the sort order %CPU descending. Then screen is refreshed every 3 seconds.
The above description is about how top works by default, out of box. However, top allows for extensive customization in terms of the output displayed and also on the way output is presented to the user. The customization can be done by command line options and also by the commands given from the Message/Prompt Line, when top is running.
Command Line Options
|-h, -v||print program version, usage prompt and quit|
batchmode. No inputs are accepted and top quits after -n number iterations
|-n||work for the given number of iterations and quit.|
|-d||delay time interval between iterations in in the format ss[.tt] seconds|
|-H||Show threads. By default, processes are displayed. LWP ids are displayed under PID.|
|-i||do not display
|-u||Report only processes with the given effective user id or user name|
|-U||Report only processes with the given real, effective, saved or filesystem user id or user name|
|-p||Monitor the processes identified by the given list of process ids.|
|-s||work in secure mode|
|-S||Display cumulative CPU time for each process and its children which have died and have been waited for by it|
There are a number of attributes or fields for processes. As the display width is limited only a subset of fields can be displayed at a time. A Field Group is a group of fields that are displayed by top at a time. There are four underlying field groups numbered 1 through 4.
Alternate Display Mode
By default, we have the full screen display mode where the process data and summary are displayed in a single window. So, at any time, only one field group can be displayed. There is also the Alternate Display Mode, where there can be a maximum of four windows, each displaying a field group. These windows are named Def, Job, Mem and Usr. By default, the Def window is sorted by %CPU, Job window by PID, Mem window by %MEM and the Usr window is sorted by the USER field. There is only one summary area, which refers to one of the windows below. The Alternate Display Mode can be entered into using the A display mode toggle command.
1:Def - 12:42:43 up 2 days, 22:49, 1 user, load average: 0.00, 0.01, 0.05 Tasks: 94 total, 1 running, 93 sleeping, 0 stopped, 0 zombie Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 1705192k total, 589372k used, 1115820k free, 147436k buffers Swap: 917500k total, 0k used, 917500k free, 197516k cached 1 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4982 ubuntu 20 0 3544 2172 960 R 7.8 0.1 0:07.58 top 1 root 20 0 2928 1756 1256 S 0.0 0.1 0:00.53 init 2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd 3 root 20 0 0 0 0 S 0.0 0.0 0:02.61 ksoftirqd/0 .... 2 PID PPID TIME+ %CPU %MEM PR NI S VIRT SWAP RES UID COMMAND 5016 747 0:00.00 0.0 0.3 20 0 S 34288 29m 4592 33 apache2 5015 747 0:00.00 0.0 0.3 20 0 S 34288 29m 4592 33 apache2 5002 747 0:01.94 0.0 1.5 20 0 S 50676 25m 24m 33 apache2 4965 747 0:05.55 0.0 1.4 20 0 S 49792 25m 23m 33 apache2 ..... 3 PID %MEM VIRT SWAP RES CODE DATA SHR nFLT nDRT S PR NI %CPU COMMAND 591 2.7 137m 92m 45m 7648 126m 6456 79 0 S 20 0 0.0 mysqld 4931 1.6 52348 24m 26m 356 29m 4964 0 0 S 20 0 0.0 apache2 4903 1.6 51500 24m 25m 356 28m 4948 0 0 S 20 0 0.0 apache2 4936 1.5 51672 24m 25m 356 29m 4948 0 0 S 20 0 0.0 apache2 ..... 4 PID PPID UID USER RUSER TIME RES %CPU %MEM S COMMAND 591 1 104 mysql mysql 4:05 45m 0.0 2.7 S mysqld 4931 747 33 www-data www-data 0:09 26m 0.0 1.6 S apache2 4903 747 33 www-data www-data 0:07 25m 0.0 1.6 S apache2 4936 747 33 www-data www-data 0:09 25m 0.0 1.5 S apache2 ......
top command output - alternate display
By default, the secure mode is off. If you give the h (help) command from the Message/Prompt area, the output is,
Help for Interactive Commands - procps version 3.2.8 Window 1:Def: Cumulative mode Off. System: Delay 3.0 secs; Secure mode Off. ....
There are three top sub-commands, which system administrators might not want all users to execute. These are,
- k, to kill a task (process/thread)
- r, to re-nice a task
- d or s, to change the delay or sleep interval
In the unsecured mode, all users can execute the above mentioned command in top. Of course, Linux permissions apply and attempts by ordinary users to kill processes owned by root will be politely declined by the system. But in secure mode, normal users are just not given to option to give the above mentioned commands.
To enforce system wide operation of top in the secure mode, create a file named toprc (there is no dot in the file name) in the /etc directory. It should have the following two lines,
s # work in secure mode 5.0 # delay interval in seconds
The second line is optional. Of course, you can skip the restrictions of the secure mode by executing top as the super user, as
When top is running, you can give commands to it interactively from the Message/Prompt Line. These commands are global commands, summary area commands, task area commands and the commands for windows.
The global commands are always available in both the full screen and alternate display modes.
|Enter, Space||Refresh display|
|h||Display help screen. A second h input displays the alternate display mode help.|
|=||Remove restrictions on display in task area. Useful for resetting the effect of i, n and p commands.|
|A||Toggle to alternate display mode and vice-versa|
|B||The global bold enable/disable toggle. The main entries in the summary area and the current window are made bold. Or, if bold is on, these return to normal display.|
|d, s||Change the delay time interval (seconds). Not available in secure mode.|
|G||Go to another window/field group|
|I||Toggle between Irix mode (I On) and Solaris mode (I Off). In the Solaris mode, the CPU usage (%CPU) is divided by the total number of CPUs in the system|
|u||Select an effective user id or user name. Only the processes belonging to this user will be displayed.|
|U||Select a real/effective/saved/file system user id or user name. Only the processes belonging to this user will be displayed.|
|k||Kill a task (process/thread). Not available in secure mode.|
|r||Re-nice a task. Not available in secure mode.|
|W||Write the user's configuration file as $HOME/.toprc. All the toggles and options are saved. Useful for starting top with the same settings as the last invocation||Z||Change text color in the four areas|
Summary Area Commands
The Summary Area Commands affect the output in the Summary Area. These commands are always available, both in full screen display and the alternate display mode. The summary area commands act on the current window. These commands are basically a set of toggle switches that turn off or on a part of the summary area.
|l (el)||Toggle the display of load average and system uptime line, the first line of top output|
|m||Toggle the display of memory and swap area lines in the Summary Area|
|t||Toggle the display of task and CPU lines in Summary Area|
|1 (one)||If task and CPU lines are displayed, 1 toggles the display of individual CPU information|
1:Def - 17:40:45 up 3 days, 12:03, 2 users, load average: 0.02, 0.12, 0.13 Tasks: 161 total, 1 running, 160 sleeping, 0 stopped, 0 zombie Cpu0 : 7.7%us, 1.6%sy, 0.0%ni, 89.4%id, 1.2%wa, 0.0%hi, 0.1%si, 0.0%st Cpu1 : 8.1%us, 2.3%sy, 0.0%ni, 88.3%id, 1.3%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 960268k total, 813520k used, 146748k free, 2928k buffers Swap: 2996116k total, 414860k used, 2581256k free, 116948k cached
1 command toggles the display for individual CPUs
Task Area Commands
The task area commands are always available in the full screen mode. However, if task area has been switched off in the alternate display mode, the task area commands are not available.
|b||Bold/Reverse Toggle. Whether x and y commands should highlight in bold or reverse video. For bold to work, the global bold should be enabled first using the B command.|
|x||Highlight the current sort field column.|
|y||Highlight the running process or thread|
|z||Color/monochrome toggle. Default is monochrome, but output looks good in color.||c||Command name/command line toggle. By default, this is off and the command name is displayed under the column COMMAND. If toggled on, command line used for executing the concerned program is given.|
|f||Field select, select the fields (columns) to be displayed in the task area|
|o||Order select, change the order of columns displayed in the task area|
|H||Threads toggle. When on, individual threads are shown. When off, processes are shown|
|S||Cumulative time toggle. When on, display cumulative CPU time for each process and its children which have died and have been waited for by it. When off, the CPU time for children is not shown.|
|u||Show processes for a particular user|
|i||Idle processes toggle. When on, all processes are shown. When off, idle and zombie processes are not displayed.|
|n||Number of processes to be displayed. As the maximum number of processes to be displayed is restricted by the number of rows available on the screen, the number of processes displayed is the min of n and maximum number of rows available on the screen.|
|F, O||Select the sort field for display of rows in the task area|
|R||Reverse the sort order for rows (ascending to descending and vice-versa)|
|<||Select the column left of current sort field for sorting the task area. The current sort field must be displayed.|
|>||Select the column right of current sort field for sorting the task area. The current sort field must be displayed.|
Commands for Windows
These commands are mostly relevant for the alternate display mode.
|- (minus)||Toggle display of task area for the current window|
|_ (underscore)||Toggle display of task area for all the four windows|
|=||Make the current windows task area visible. Reset any i (idle tasks) or n (max tasks) customization done earlier. Other customizations, done earlier, are retained. Available in both full screen and alternative display modes.|
|+||Make task area visible for all windows. Reset any i (idle tasks) or n (max tasks) customization done earlier. Other customizations, done earlier, are retained.|
|A||Display mode toggle. Switch full screen display to alternate display mode and vice-versa. Available in both full screen and alternative display modes.|
|a||Go to next window forward, which becomes the current window.|
|w||Go to the previous window backwards, making it the current window|
|G||Choose another field group|
|g||Change window name|
Using the configuration file
Using the W command, you can save the top settings in the file, $HOME/.toprc. When top is run next time, it reads the settings form this file and works the same way as the time settings were saved last.
- top manual entry, given by the command, man top