15 simple TOP command examples on Linux to monitor processes

Linux TOP command

One of the most basic command to monitor processes on Linux is the top command. As the name suggests, it shows the top processes based on certain criterias like cpu usage or memory usage.

The processes are listed out in a list with multiple columns for details like process name, pid, user, cpu usage, memory usage.

Apart from the list of processes, the top command also shows brief stats about average system load, cpu usage and ram usage on the top.

This post shows you some very simple examples of how to use the top command to monitor processes on your linux machine or server.

Note your "top" command variant

Be aware that the top command comes in various variants and each has a slightly different set of options and method of usage.

To check your top command version and variant use the -v option

$ top -v
  procps-ng version 3.3.9

This post focuses on the top command coming from the procps-ng project. This is the version available on most modern distros like Ubunut, Fedora, CentOS etc.

1. Display processes

To get a glimpse of the running processes, just run the top command as is without any options like this.

$ top

And immediately the output would be something like this -

top - 18:50:35 up  9:05,  5 users,  load average: 0.68, 0.52, 0.39
Tasks: 254 total,   1 running, 252 sleeping,   0 stopped,   1 zombie
%Cpu(s):  2.3 us,  0.5 sy,  0.0 ni, 97.1 id,  0.2 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8165300 total,  6567896 used,  1597404 free,   219232 buffers
KiB Swap:  1998844 total,        0 used,  1998844 free.  2445372 cached Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND             
17952 enlight+  20   0 1062096 363340  88068 S   4.8  4.4   0:49.33 chrome              
14294 enlight+  20   0  954752 203548  61404 S   2.1  2.5   2:00.91 chrome              
 1364 root      20   0  519048 105704  65348 S   0.6  1.3  17:31.27 Xorg                
19211 enlight+  20   0  576608  47216  39136 S   0.6  0.6   0:01.01 konsole             
   13 root      rt   0       0      0      0 S   0.3  0.0   0:00.10 watchdog/1          
   25 root      20   0       0      0      0 S   0.3  0.0   0:03.49 rcuos/2             
 1724 enlight+  20   0  430144  36456  32608 S   0.3  0.4   0:03.60 akonadi_contact     
 1869 enlight+  20   0  534708  52700  38132 S   0.3  0.6   0:53.94 yakuake             
14040 enlight+  20   0  858176 133944  61152 S   0.3  1.6   0:09.89 chrome






The screen contains a lot of information about the system. The header areas include uptime, load average, cpu usage, memory usage data.

The process list shows all the processes with various process specific details in separate columns.
Some of the column names are pretty self explanatory.

PID - Process ID
USER - The system user account running the process.
%CPU - CPU usage by the process.
%MEM - Memory usage by the process
COMMAND - The command (executable file) of the process

2. Sort by Memory/Cpu/Process ID/Running Time

To find the process consuming the most cpu or memory, simply sort the list.

Press M key ( yes, in capital, not small ) to sort the process list by memory usage. Processes using the most memory are shown first and rest in order.

Here are other options to sort by CPU usage, Process ID and Running Time -

Press 'P' - to sort the process list by cpu usage.
Press 'N' - to sort the list by process id
Press 'T' - to sort by the running time.

3. Reverse the sorting order - 'R'

By default the sorting is done in descending order. Pressing 'R' shall reverse the sorting order of the currently sorted column

Here is the output sorted in ascending order of cpu usage. Processes consuming the least amount of cpu are shown first.

top - 17:37:55 up  8:25,  3 users,  load average: 0.74, 0.88, 0.74
Tasks: 245 total,   1 running, 243 sleeping,   0 stopped,   1 zombie
%Cpu(s):  5.2 us,  1.7 sy,  0.0 ni, 93.2 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8165300 total,  6089388 used,  2075912 free,   199060 buffers
KiB Swap:  1998844 total,        0 used,  1998844 free.  1952412 cached Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND     
    1 root      20   0  185308   6020   4012 S   0.0  0.1   0:01.90 systemd     
    2 root      20   0       0      0      0 S   0.0  0.0   0:00.00 kthreadd    
    3 root      20   0       0      0      0 S   0.0  0.0   0:00.16 ksoftirqd/0 
    5 root       0 -20       0      0      0 S   0.0  0.0   0:00.00 kworker/0:+ 
    7 root      20   0       0      0      0 S   0.0  0.0   0:06.98 rcu_sched   
    8 root      20   0       0      0      0 S   0.0  0.0   0:00.00 rcu_bh

4. Highlight the sorted column with bold text - 'x'

Press x, to highlight the values in the sort column with bold text. Here is a screenshot, with the memory column in bold text -

top command highlight column

top command highlight column

5. Highlight sorted column background color 'b'

After highlighting the sorted column with bold font, its further possible to highlight with a different background color as well. This is how it looks

Top command highlight column background

Top command highlight column background

6. Change the update delay - 'd'

The top command updates the information on the screen every 3.0 seconds by default. This refresh interval can be changed.

Press the 'd' key, and top will ask you to enter the time interval between each refresh. You can enter numbers smaller than 1 second as well, like 0.5. Enter the desired interval and hit Enter.

top - 18:48:23 up  9:19,  3 users,  load average: 0.27, 0.46, 0.39
Tasks: 254 total,   1 running, 252 sleeping,   0 stopped,   1 zombie
%Cpu(s):  1.3 us,  0.4 sy,  0.0 ni, 98.1 id,  0.2 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8165300 total,  7899784 used,   265516 free,   238068 buffers
KiB Swap:  1998844 total,     5432 used,  1993412 free.  3931316 cached Mem
Change delay from 3.0 to 
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND     
14512 enlight+  20   0 1047688 302532  87156 S   1.3  3.7   1:34.87 /opt/googl+ 
15312 enlight+  20   0   25148   3280   2628 R   0.8  0.0   0:00.04 top

7. Filter or Search processes - 'o'/'O'

You can filter the process list based on various criterias like process name, memory usage, cpu usage etc. Multiple filter criterias can be applied.

Press the 'o' or 'O' to activate filter prompt. It will show a line indicating the filter format like this -

add filter #1 (ignoring case) as: [!]FLD?VAL

Then enter a filter like this and hit Enter.

COMMAND=apache

Now top will show only those processes whose COMMAND field contains the value apache.

Here is another filter example that shows processes consuming CPU actively -

%CPU>0.0

See active filters - Press Ctrl+o to see currently active filters

Clear filter - Press '=' key to clear any active filters

8. Display full command path and arguments of process - 'c'

Press 'c' to display the full command path along with the commandline arguments in the COMMAND column.

%CPU %MEM     TIME+ COMMAND                                                    
  0.0  0.0   0:00.00 /usr/bin/dbus-launch --exit-with-session /usr/bin/im-laun+ 
  0.0  0.1   0:01.52 /usr/bin/dbus-daemon --fork --print-pid 5 --print-address+ 
  0.0  0.3   0:00.41 /usr/bin/kwalletd --pam-login 17 20                        
  0.0  0.0   0:00.00 /usr/lib/x86_64-linux-gnu/libexec/kf5/start_kdeinit --kde+ 
  0.0  0.3   0:01.55 klauncher [kdeinit5] --fd=9                                
  0.0  0.2   0:00.13 /usr/lib/telepathy/mission-control-5                       
  0.0  0.1   0:00.00 /usr/lib/dconf/dconf-service                               
  0.0  0.4   0:01.41 /usr/lib/x86_64-linux-gnu/libexec/kdeconnectd              
  0.0  0.2   0:01.09 /usr/lib/x86_64-linux-gnu/libexec/kf5/kscreen_backend_lau+

9. View processes of a user - 'u'/'U'

To view the processes of a specific user only, press 'u' and then top will ask you to enter the username.

Which user (blank for all)
Enter the desired username and hit Enter.

top - 17:33:46 up  8:21,  3 users,  load average: 2.55, 1.31, 0.81
Tasks: 246 total,   1 running, 244 sleeping,   0 stopped,   1 zombie
%Cpu(s): 11.8 us,  3.3 sy,  0.6 ni, 84.2 id,  0.0 wa,  0.0 hi,  0.1 si,  0.0 st
KiB Mem:   8165300 total,  6108824 used,  2056476 free,   198680 buffers
KiB Swap:  1998844 total,        0 used,  1998844 free.  1963436 cached Mem
Which user (blank for all) enlightened
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND     
 1696 enlight+  20   0  440728  37728  33724 S   0.0  0.5   0:03.12 akonadi_bi+ 
 1705 enlight+  20   0  430304  37156  33264 S   0.0  0.5   0:03.08 akonadi_mi+ 
 1697 enlight+  20   0  430144  37100  33248 S   0.0  0.5   0:03.00 akonadi_co+ 
 1599 enlight+  20   0  504628  36132  32068 S   0.0  0.4   0:03.24 kdeconnectd 
 1608 enlight+  20   0  570784  35688  29944 S   0.0  0.4   0:02.87 polkit-kde+ 
 1584 enlight+  20   0  781016  33308  29056 S   0.0  0.4   0:04.03 kactivitym+

10. Toggle the display of idle processes - 'i'

Press 'i' to toggle the display of idle/sleeping processes. By default all processes are display.

11. Hide/Show the information on top - 'l', 't', 'm'

The 'l' key would hide the load average information.
The 'm' key will hide the memory information.
The 't' key would hide the task and cpu information.

Hiding the header information area, makes more processes visible in the list.

12. Forest mode - 'V'

Pressing 'V' will display the processes in a parent child hierarchy. It looks something like this -

top - 09:29:34 up 17 min,  3 users,  load average: 0.37, 0.58, 0.66
Tasks: 244 total,   1 running, 242 sleeping,   0 stopped,   1 zombie
%Cpu(s):  6.1 us,  2.1 sy,  0.0 ni, 91.8 id,  0.1 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8165300 total,  3968224 used,  4197076 free,    82868 buffers
KiB Swap:  1998844 total,        0 used,  1998844 free.  1008416 cached Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND             
    1 root      20   0   37844   5964   4012 S   0.0  0.1   0:01.08 systemd             
  279 root      20   0   35376   4132   3732 S   0.0  0.1   0:00.22  `- systemd-journal 
  293 root      20   0   44912   4388   3100 S   0.0  0.1   0:00.14  `- systemd-udevd   
  493 systemd+  20   0  102360   2844   2572 S   0.0  0.0   0:00.01  `- systemd-timesyn 
  614 root      20   0  337360   8624   6904 S   0.0  0.1   0:00.03  `- ModemManager    
  615 avahi     20   0   40188   3464   3096 S   0.0  0.0   0:00.01  `- avahi-daemon    
  660 avahi     20   0   40068    324     12 S   0.0  0.0   0:00.00      `- avahi-daem+ 
  617 root      20   0  166276   8788   8076 S   0.0  0.1   0:00.07  `- thermald        
  621 root      20   0   15664   2496   2312 S   0.0  0.0   0:00.00  `- anacron         
 2792 root      20   0    4476    844    760 S   0.0  0.0   0:00.00      `- sh          
 2793 root      20   0    4364    684    604 S   0.0  0.0   0:00.00          `- run-pa+ 
 2802 root      20   0    4476   1672   1536 S   0.0  0.0   0:00.00              `- apt 
 2838 root      20   0    7228    676    596 S   0.0  0.0   0:00.00                  `+ 
  630 root      20   0   28932   3128   2860 S   0.0  0.0   0:00.00  `- cron            
  634 root      20   0  283120   6776   5924 S   0.0  0.1   0:00.04  `- accounts-daemon 
  636 root      20   0   86160   7224   6128 S   0.0  0.1   0:00.01  `- cupsd

13. Change the number of processes to display - 'n'

Lets say you want to monitor only few processes based on a certain filter criteria. Press 'n' and enter the number of processes you wish to display.

It will display a line saying -
Maximum tasks = 0, change to (0 is unlimited)

14. Display all CPU cores - '1'

Pressing '1' will display the load information about individual cpu cores. Here is how it looks -

top - 10:45:47 up  1:42,  5 users,  load average: 0.81, 1.14, 0.94
Tasks: 260 total,   2 running, 257 sleeping,   0 stopped,   1 zombie
%Cpu0  :  3.6 us,  3.6 sy,  0.0 ni, 92.9 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
%Cpu1  :  3.1 us,  3.6 sy,  0.0 ni, 93.3 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
%Cpu2  :  7.6 us,  1.8 sy,  0.0 ni, 90.7 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
%Cpu3  :  9.6 us,  2.6 sy,  0.0 ni, 87.7 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8165300 total,  7118864 used,  1046436 free,   204224 buffers
KiB Swap:  1998844 total,        0 used,  1998844 free.  3410364 cached Mem

15. Show/Hide columns 'f'

By default top displays only few columns out of many more that it can display. If you want to add or remove a particular column or change the order of columns, then press f

Fields Management for window 1:Def, whose current sort field is %CPU
   Navigate with Up/Dn, Right selects for move then <Enter> or Left commits,
   'd' or <Space> toggles display, 's' sets sort.  Use 'q' or <Esc> to end!

* PID     = Process Id      PGRP    = Process Group   vMj     = Major Faults 
* USER    = Effective Use   TTY     = Controlling T   vMn     = Minor Faults 
  PR      = Priority        TPGID   = Tty Process G   USED    = Res+Swap Size
  NI      = Nice Value      SID     = Session Id      nsIPC   = IPC namespace
  VIRT    = Virtual Image   nTH     = Number of Thr   nsMNT   = MNT namespace
  RES     = Resident Size   P       = Last Used Cpu   nsNET   = NET namespace
  SHR     = Shared Memory   TIME    = CPU Time        nsPID   = PID namespace
  S       = Process Statu   SWAP    = Swapped Size    nsUSER  = USER namespac
* %CPU    = CPU Usage       CODE    = Code Size (Ki   nsUTS   = UTS namespace
* %MEM    = Memory Usage    DATA    = Data+Stack (K
  TIME+   = CPU Time, hun   nMaj    = Major Page Fa
* COMMAND = Command Name/   nMin    = Minor Page Fa
  PPID    = Parent Proces   nDRT    = Dirty Pages C
  UID     = Effective Use   WCHAN   = Sleeping in F
  RUID    = Real User Id    Flags   = Task Flags <s
  RUSER   = Real User Nam   CGROUPS = Control Group
  SUID    = Saved User Id   SUPGIDS = Supp Groups I
  SUSER   = Saved User Na   SUPGRPS = Supp Groups N
  GID     = Group Id        TGID    = Thread Group 
  GROUP   = Group Name      ENVIRON = Environment v

The fields marked * or bold are the fields that are displayed, in the order in which they appear in this list.

Navigate the list using up/down arrow keys and press 'd' to toggle the display of that field. Once done, press q to go back to the process list

The following output displays only PID, USER, CPU, MEMORY and COMMAND columns.

top - 15:29:03 up  6:16,  4 users,  load average: 0.99, 0.61, 0.63
Tasks: 247 total,   1 running, 245 sleeping,   0 stopped,   1 zombie
%Cpu(s):  6.3 us,  2.0 sy,  0.2 ni, 91.5 id,  0.1 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem:   8165300 total,  6089244 used,  2076056 free,   189272 buffers
KiB Swap:  1998844 total,        0 used,  1998844 free.  1902836 cached Mem

  PID USER      %CPU %MEM COMMAND                                               
 1921 enlight+   9.2  3.6 /opt/google/chrome/chrome                             
 3078 enlight+   6.9  4.2 /opt/google/chrome/chrome --type=renderer --lang=en-+ 
 1231 root       5.3  1.0 /usr/bin/X :0 -auth /var/run/sddm/:0 -nolisten tcp -+ 
 1605 enlight+   2.8  2.5 /usr/bin/plasmashell --shut-up                        
 1596 enlight+   1.8  1.0 kwin_x11 -session 10d8d4e36b000144740943900000009530+ 
 2088 enlight+   0.9  1.7 /opt/google/chrome/chrome --type=renderer --lang=en-+ 
 2534 enlight+   0.8  1.7 /opt/google/chrome/chrome --type=renderer --lang=en-+ 
 5695 enlight+   0.8  0.7 /usr/bin/python /usr/bin/terminator                   
 1859 enlight+   0.2  1.2 /usr/bin/perl /usr/bin/shutter --min_at_startup       
 2060 enlight+   0.2  1.5 /opt/google/chrome/chrome --type=renderer --lang=en-+ 
 3541 enlight+   0.2  3.6 /opt/google/chrome/chrome --type=renderer --lang=en-+

16. Batch mode

Top also supports batch mode output, where it would keep printing information sequentially instead of a single screen. This is useful when you need to log the top output for later analysis of some kind.

Here is a simple example that shows the Cpu usage at intervals of 1 second.

$ top -d 1.0 -b | grep Cpu

17. Split output in multiple panels - 'A'

Each panel can be sorted on a different column. Press 'a' to move through the panels. Each panel can have a different set of fields displayed and different sort columns.

top command multiple panels

top command multiple panels

Conclusion

If you are looking for something easier and with a better user interface try htop. Htop has a intuitive user interface, where you need not memorize keyboard shortcuts. Htop has onscreen instructions that guide you on how to use it.

Last Updated On : 9th March 2016

Subscribe to get updates delivered to your inbox

1 Comment + Add Comment

  • Very helpful article and learned so many after read.

Leave a comment