top Command in Linux

  • Post author:
  • Post last modified:August 23, 2023
  • Reading time:18 mins read

The Unix top command is useful for monitoring systems continuously for processes that take more system resources like the CPU time and the memory. top periodically updates the display showing the high resource consuming processes at the top. top is an excellent aid in checking a system. If your Linux or Unix system is giving a slow response time, just run top and look for statistics like – load average, CPU utilization, memory and swap usage and the top CPU and memory intensive processes. The chances are that you will get a fair idea of what is happening in the system. The top command can be started simply by giving the command,


The top command output is a screen, like

top - 13:36:07 up  3:42,  2 users,  load average: 0.30, 0.25, 0.19
Tasks: 199 total,   2 running, 196 sleeping,   0 stopped,   1 zombie
%Cpu(s):  5.6 us,  0.5 sy,  0.0 ni, 93.8 id,  0.2 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   1786900 total,  1221432 used,   565468 free,    45132 buffers
KiB Swap:  1512444 total,   117296 used,  1395148 free,   659152 cached

 4648 user1     20   0  138m  16m  11m S   3.3  0.9   0:00.97 gnome-terminal
 1013 root      20   0  162m  26m  18m S   2.7  1.5   1:51.35 Xorg
 4623 user1     20   0  330m 103m  31m S   2.3  5.9   0:10.16 chrome
 1952 user1     20   0  302m  31m  13m S   2.0  1.8   1:26.82 compiz
 4723 user1     20   0  5336 1360  952 R   0.7  0.1   0:00.10 top
   87 root      20   0     0    0    0 S   0.3  0.0   0:02.10 kworker/3:1
 1695 user1     20   0 46508 3096 2280 S   0.3  0.2   0:01.98 ibus-daemon
 1773 user1     20   0  3764  604  588 S   0.3  0.0   0:05.91 syndaemon
 1856 user1     20   0 85616  11m 9.8m S   0.3  0.7   0:01.60 gnome-screensav
 4102 user1     20   0  615m 111m  52m R   0.3  6.4   1:00.99 chrome
    1 root      20   0  4052 1884 1104 S   0.0  0.1   0:01.51 init
    2 root      20   0     0    0    0 S   0.0  0.0   0:00.00 kthreadd
    3 root      20   0     0    0    0 S   0.0  0.0   0:00.30 ksoftirqd/0
    4 root      20   0     0    0    0 S   0.0  0.0   0:02.57 kworker/0:0
    5 root       0 -20     0    0    0 S   0.0  0.0   0:00.00 kworker/0:0H
    7 root      rt   0     0    0    0 S   0.0  0.0   0:00.00 migration/0
    8 root      20   0     0    0    0 S   0.0  0.0   0:00.00 rcu_bh
    9 root      20   0     0    0    0 S   0.0  0.0   0:03.14 rcu_sched
   10 root      rt   0     0    0    0 S   0.0  0.0   0:00.05 watchdog/0
   11 root      rt   0     0    0    0 S   0.0  0.0   0:00.05 watchdog/1

top command output

There are four areas in the top command output, which are the Summary Area, Message/Prompt Line, Columns Header and Task Area. The first five lines make the Summary Area. The Summary Area gives the system status in a summarized form. The first line gives the command name, current system time, system uptime, number of current users and the load average for the last one minute, five minutes and fifteen minutes respectively. The next line gives a count of total number of processes in the system and also the state-wise count of these processes is also given. The next line gives CPU utilization between now and the time of last refresh. In the case of the above output, the breakup of CPU time as a percentage since last refresh is that 5.6% of CPU time has been spent in executing user processes that are not nice'd (us), 0.5% time has been spent in running the kernel and its processes (sy), 0.0% time has been spent on user processes that have been nice'd (ni), 93.8% of the time CPU(s) is/are idle (id), 0.2% of the time CPU(s) is/are waiting for I/O to complete (wa), 0.0% of the time is spent in servicing hardware interrupts (hi), 0.0% of the time is spent in servicing software interrupts (si), and, finally, 0.0% is the steal time which has been stolen from this virtual machine by the hypervisor for other tasks (st), like running another virtual machine. The next two lines give details about the memory usage in the system. In this case, the total memory is 1,786,900 kilobytes, out of which 1,221,432k is used and 565,468k is free. 45,132k of memory is used for block I/O buffers (Buffers). In the next line under Swap, there is the important statistic at the end, Cached, which is 659,152k and is most of the Linux page cache. (Page cache is Cached and SwapCached memories put together; SwapCache is not given in the above output). Since Cached and Buffers together shrink to cater to the dynamic memory demands from processes, the actual free memory is free memory reported plus Cached plus Buffers, which, in this case, is 1,269,752k. Also given in the last line is the total swap space, which, in this case, is 1,512,444k. of this, the swap memory used is 117,296k and the rest, 1,395,148k is free.

The next area is the Message/Prompt Line, which is a single line after the Summary Area. The cursor is normally at the beginning of this line, prompting entry of user sub-commands for top. The error messages are also displayed here. Next, is the Columns Header area, displaying column headings. After that, we have the Task Area. A task is a process or a thread. So in the task area, the details of the processes or threads are displayed, one per line. By default, the process details are displayed. The process details displayed are, the process id (PID), effective user name of the owner (USER), priority (PR), nice value (NI), total amount of virtual memory used (VIRT), resident size – the non-swapped physical memory used (RES), shared memory – memory that could potentially be shared (SHR), status (S), percentage of the CPU time (%CPU) used since the last refresh, physical memory used (%MEM) as a percentage of available physical memory, total CPU time (TIME+) used since the start given in the grainuality of hundredths of a second and the command (COMMAND) name. The process status values are running (R), sleeping (S), uninterruptible sleep (D), traced or stopped (T) and zombie (Z). Processes shown as running as actually ready to run, being on the run queue of the system. The processes are listed in the sort order %CPU descending. Then screen is refreshed every 3 seconds.

The above description is about how top works by default, out of box. However, top allows for extensive customization in terms of the output displayed and also on the way output is presented to the user. The customization can be done by command line options and also by the commands given from the Message/Prompt Line, when top is running.

Command Line Options

top – Important Command Line Options
Option Description
-h, -v print program version, usage prompt and quit
-b work in batch mode. No inputs are accepted and top quits after -n number iterations
-n work for the given number of iterations and quit.
-d delay time interval between iterations in in the format ss[.tt] seconds
-H Show threads. By default, processes are displayed. LWP ids are displayed under PID.
-i do not display idle processes
-u Report only processes with the given effective user id or user name
-U Report only processes with the given real, effective, saved or filesystem user id or user name
-p Monitor the processes identified by the given list of process ids.
-s work in secure mode
-S Display cumulative CPU time for each process and its children which have died and have been waited for by it

Field Groups

There are a number of attributes or fields for tasks. As the display width is limited, only a few fields can be displayed at any time. A Field Group is a group of fields that are displayed for tasks by top at a time. There are four underlying field groups numbered 1 through 4.

Alternate Display Mode

By default, we have the full screen display mode where the summary and the task data are displayed in a single window. So, at any time, only one field group can be displayed. There is also the Alternate Display Mode, where there can be a maximum of four windows, each displaying a field group. These windows are named Def, Job, Mem and Usr. By default, the Def window is sorted by %CPU, Job window by the PID, Mem window by %MEM and the Usr window is sorted by the USER field. There is only one summary area, which refers to one of the windows below. The Alternate Display Mode can be entered into using the A display mode toggle command.

1:Def - 18:09:16 up  8:15,  3 users,  load average: 0.15, 0.13, 0.19
Tasks: 209 total,   1 running, 207 sleeping,   0 stopped,   1 zombie
%Cpu(s):  1.5 us,  0.5 sy,  0.0 ni, 97.1 id,  0.9 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   1786900 total,  1367608 used,   419292 free,    28960 buffers
KiB Swap:  1512444 total,   138100 used,  1374344 free,   506544 cached

  1013 root      20   0  169m  27m  19m S   2.3  1.6   5:45.23 Xorg
  4648 user1     20   0  143m  20m  12m S   2.3  1.2   0:40.31 gnome-terminal
  1952 user1     20   0  312m  32m  13m S   2.0  1.9   4:15.86 compiz
  5614 user1     20   0  334m  98m  33m S   0.7  5.7   5:14.19 chrome

  7337  4658   0:00.42   0.3  0.1  20   0 R  5340    0 1368  1000 top
  7324     2   0:00.00   0.0  0.0  20   0 S     0    0    0     0 kworker/u16:2
  7288     2   0:00.00   0.0  0.0   0 -20 S     0    0    0     0 kworker/u17:1
  7244     2   0:00.28   0.0  0.0  20   0 S     0    0    0     0 kworker/u16:0
  4102  8.4  687m    0 147m  79m 398m  54m  249    0 S  20   0   0.3 chrome
  4138  6.4  662m    0 110m  79m 467m  29m   30    0 S  20   0   0.0 chrome
  6174  6.1  328m    0 106m  79m 156m  28m    0    0 S  20   0   0.3 chrome
  5614  5.7  334m    0  98m  79m 161m  33m    5    0 S  20   0   0.7 chrome

  1049     1   108 whoopsie whoopsie ?          0:01.02   0.0  0.2 S whoopsie
   731     1   101 syslog   syslog   ?          0:02.13   0.0  0.1 S rsyslogd
  1390     1   107 rtkit    rtkit    ?          0:00.36   0.0  0.1 S rtkit-daemon
     1     0     0 root     root     ?          0:01.53   0.0  0.1 S init

top command output – alternate display

Secure mode

By default, the secure mode is off. If you give the h (help) command from the Message/Prompt area, the output is,

Help for Interactive Commands - procps version 3.2.8
Window 1:Def: Cumulative mode Off.  System: Delay 3.0 secs; Secure mode Off.

There are three top sub-commands, which system administrators might not want all users to execute. These are,

  • k, to kill a task (process/thread)
  • r, to re-nice a task
  • d or s, to change the delay or sleep interval

In the unsecured mode, all users can execute the above mentioned command in top. Of course, Linux permissions apply and any attempts made by ordinary users to kill processes owned by root are not permitted. But in secure mode, normal users are just not given to option to give the above mentioned commands.

To enforce system wide operation of top in the secure mode, create a file named toprc (there is no dot in the file name) in the /etc directory. It should have the following two lines,

   s         # work in secure mode
   5.0       # delay interval in seconds

The second line is optional. Of course, you can skip the restrictions of the secure mode by executing top as the super user, as

sudo top

top sub-commands

When top is running, you can give commands to it interactively from the Message/Prompt Line. These commands are global commands, summary area commands, task area commands and the commands for windows.

Global Commands

The global commands are always available in both the full screen and alternate display modes.

top – Important global commands
Option Description
Enter, Space Refresh display
h Display help screen. A second h input displays the alternate display mode help.
= Remove restrictions on display in task area. Useful for resetting the effect of i, n and p commands.
A Toggle to alternate display mode and vice-versa
B The global bold enable/disable toggle. The main entries in the summary area and the current window are made bold. Or, if bold is on, these return to normal display.
d, s Change the delay time interval (seconds). Not available in secure mode.
g Go to another window/field group
I Toggle between Irix mode (I On) and Solaris mode (I Off). In the Solaris mode, the CPU usage (%CPU) is divided by the total number of CPUs in the system
u Select an effective user id or user name. Only the processes belonging to this user will be displayed.
U Select a real/effective/saved/file system user id or user name. Only the processes belonging to this user will be displayed.
k Kill a task (process/thread). Not available in secure mode.
q Quit
r Re-nice a task. Not available in secure mode.
W Write the user's configuration file as $HOME/.toprc. All the toggles and options are saved. Useful for starting top with the same settings as the last invocation
Z Change text color in the four areas

Summary Area Commands

The Summary Area Commands affect the output in the Summary Area. These commands are always available, both in full screen display and the alternate display mode. The summary area commands act on the current window. These commands are basically a set of toggle switches that turn off or on a part of the summary area.

top – Summary Area Commands
Option Description
l (el) Toggle the display of load average and system uptime line, the first line of top output
m Toggle the display of memory and swap area lines in the Summary Area
t Toggle the display of task and CPU lines in Summary Area
1 (one) If task and CPU lines are displayed, 1 toggles the display of individual CPU information
1:Def - 17:40:45 up 3 days, 12:03,  2 users,  load average: 0.02, 0.12, 0.13
Tasks: 161 total,   1 running, 160 sleeping,   0 stopped,   0 zombie
Cpu0  :  7.7%us,  1.6%sy,  0.0%ni, 89.4%id,  1.2%wa,  0.0%hi,  0.1%si,  0.0%st  
Cpu1  :  8.1%us,  2.3%sy,  0.0%ni, 88.3%id,  1.3%wa,  0.0%hi,  0.0%si,  0.0%st  
Mem:    960268k total,   813520k used,   146748k free,     2928k buffers
Swap:  2996116k total,   414860k used,  2581256k free,   116948k cached

1 command toggles the display for individual CPUs

Task Area Commands

The task area commands are always available in the full screen mode. However, if task area has been switched off in the alternate display mode, the task area commands are not available.

top – Task Area Commands
Option Description
b Bold/Reverse Toggle. Whether x and y commands should highlight in bold or reverse video. For bold to work, the global bold should be enabled first using the B command.
x Highlight the current sort field column.
y Highlight the running process or thread
z Color/monochrome toggle. Default is monochrome, but output looks good in color.
c Command name/command line toggle. By default, this is off and the command name is displayed under the column COMMAND. If toggled on, command line used for executing the concerned program is given.
f Field select, select the fields (columns) to be displayed in the task area
H Threads toggle. When on, individual threads are shown. When off, processes are shown
S Cumulative time toggle. When on, display cumulative CPU time for each process and its children which have died and have been waited for by it. When off, the CPU time for children is not shown.
u Show processes for a particular user
i Idle processes toggle. When on, all processes are shown. When off, idle and zombie processes are not displayed.
n Number of processes to be displayed. As the maximum number of processes to be displayed is restricted by the number of rows available on the screen, the number of processes displayed is the min of n and maximum number of rows available on the screen.
F Select the sort field for display of rows in the task area
R Reverse the sort order for rows (ascending to descending and vice-versa)
< Select the column left of current sort field for sorting the task area. The current sort field must be displayed.
> Select the column right of current sort field for sorting the task area. The current sort field must be displayed.

Commands for Windows

These commands are mostly relevant for the alternate display mode.

top – Commands for Windows
Option Description
– (minus) Toggle display of task area for the current window
_ (underscore) Toggle display of task area for all the four windows
= Make the current windows task area visible. Reset any i (idle tasks) or n (max tasks) customization done earlier. Other customizations, done earlier, are retained. Available in both full screen and alternative display modes.
+ Make task area visible for all windows. Reset any i (idle tasks) or n (max tasks) customization done earlier. Other customizations, done earlier, are retained.
A Display mode toggle. Switch full screen display to alternate display mode and vice-versa. Available in both full screen and alternative display modes.
a Go to next window forward, which becomes the current window.
w Go to the previous window backwards, making it the current window
G Choose another field group
g Change window name

Using the configuration file

Using the W command, you can save the top settings in the file, $HOME/.toprc. When top is run next time, it reads the settings form this file and works the same way as the time settings were saved last.


  • top manual entry, given by the command, man top

See also


Karunesh Johri

Software developer, working with C and Linux.
0 0 votes
Article Rating
Notify of
Inline Feedbacks
View all comments