2023 What Is Top Command In Linux : An In-Depth Guide for the BEST system admins

Welcome all Techies who have landed on this page.

Linux, being an open-source operating system, offers a wide range of powerful commands that enable users to manage and monitor their systems efficiently. One such command that plays a crucial role in system monitoring is the Top command. In this article, we will dive deep into understanding What Is Top Command In Linux, how it works, and how it can be effectively utilized in Linux systems.


What Is Top Command In Linux


What Is Top Command In Linux?

The Top command in Linux is a powerful utility that provides real-time, dynamic information about system processes. It displays a list of running processes and their resource utilization statistics, including CPU usage, memory consumption, process IDs, and more.

The top program periodically displays a sorted list of system processes. The default sorting key is pid, but other keys can be used instead.  Various output options are available.


Why Is the Top Command Important?

The Top command is an essential tool for system administrators and advanced Linux users. It allows them to monitor system performance, identify resource-intensive processes, troubleshoot issues, and optimize system utilization. By providing real-time insights into system processes, the Top command enables users to make informed decisions regarding resource allocation and system management.

How to Use the Top Command

When operating top, the two most important keys are the help (’h’ or ’?’) and the quit (’q’) key.  Alternatively, you could simply use the traditional interrupt key (’^C’) when you’re done.

When you start top for the first time, you’ll be presented with the traditional screen elements: 1) Summary Area; 2) Message/Prompt Line; 3) Columns Header; 4) Task Area. 

Using the Top command in Linux is relatively straightforward. Simply open a terminal window and type top to launch the command. The Top command interface consists of multiple sections, each providing specific information about system processes. Let’s explore some of the key sections and their functionalities:

1. Summary Area

The summary area at the top of the Top command interface provides an overview of system statistics. It displays information such as system uptime, the number of running processes, CPU usage percentages, memory usage, and more. This section gives users a quick snapshot of the system’s current state.

2. Process Table

The process table is the heart of the Top command interface. It lists all running processes in real time, along with their corresponding details. Each row represents a process and displays information such as process ID (PID), user, CPU usage percentage, memory usage, and process priority. The process table is continuously updated, allowing users to monitor changes in process states.

3. Sorting Processes

The Top command provides the flexibility to sort processes based on different criteria. Users can press specific keys to sort processes by CPU usage, memory consumption, process ID, and more. Sorting processes help in identifying resource-intensive tasks and monitoring their impact on system performance.

4. Interacting with Processes

The Top command allows users to interact with processes directly from the command interface. By selecting a process and pressing a designated key, users can send signals to processes, such as terminating or suspending them. This feature provides control over individual processes without the need for additional commands or utilities.


Simple Examples:

Note: We need to press ‘q’ to ‘quit’ from the top command screen.


top -v: To know the version

What Is Top Command In Linux


top: To list all processes with complete details. You can also check the load average in the top command.


What Is Top Command In Linux

To list only 10 processes

top -n 10

What Is Top Command In Linux


To list only a specific process: We can see that the process ‘init’ whose PID is 1 has been running for 3.28 minutes taking 0% CPU and memory utilisation.

~]# top | grep init

 PID   USER      PR  NI   VIRT     RES  SHR S     %CPU      %MEM            TIME+        COMMAND                                                                                                                                                                                         

 1     root      20   0   19336    652  392 S     0.0        0.0             0:03.28     init 


Please find more details below which could be helpful.

You may also like which will be useful if you are a system admin:

[2023] netstat Command To Check Port: A powerful tool in a network admin’s arsenal

You can refer to books also:

Linux All-In-One for Dummies




Linux TOP Command Explained in detail:



You will see a lot of details when you run the top command. Below are the fields to focus on.

CPU:        Percentage of processor usage, broken into user, system, and idle components.  The period for which these percentages are calculated depends on the event counting mode.

Disks:       Number and total size of disk read and writes.

LoadAvg:     Load average over 1, 5, and 15 minutes.  The load average is the average number of jobs in the run queue.

MemRegions:    Number and total size of memory regions, and total size of memory regions broken into private (broken into non-library and library) and shared components.

Networks:    Number and total size of input and output network packets.

PhysMem:     Physical memory usage, broken into wired, active, inactive, used, and free components.

Procs:      Total number of processes and number of processes in each process state

Threads:     Number of threads.

Time:        Time, in H:MM: SS format.  When running in logging mode, Time is in YYYY/MM/DD HH:MM: SS format by default, but may be overridden with accumulative mode.  When running in accumulative event counting mode, the Time

                 is in HH:MM: SS since the beginning of the top process.

VirtMem:     Total virtual memory, virtual memory consumed by shared libraries, and several pageins and pageouts.

Swap:        Swap usage: total size of swap areas, amount of swap space in use and amount of swap space available.

Purgeable:   Number of pages purged and several pages currently purgeable.


Different types of process status:

  • D: Uninterruptible sleep
  • R: Running
  • S: Sleeping
  • T: Traced (stopped)
  • Z: Zombie


Sorting the values as per the requirement:

You can apply sorting of the processes by pressing the below buttons:

P: The %CPU column ( by Default)
M: The %MEM column.
N: The PID column.
T: The TIME column.


Startup Defaults:

The following startup defaults assume no configuration file, thus no user customizations.  Even so, items shown with an asterisk (’*’) could be overridden through the command line.


            * ’d’ – Delay time       3.0 seconds

              ’B’ – Bold disable     Off


              ’l’ – Load Avg/Uptime  On  (thus program name)

              ’t’ – Task/Cpu states  On  (1+1 lines, see ’1’)

              ’m’ – Mem/Swap usage   On  (2 lines worth)

              ’1’ – Single Cpu       On  (thus 1 line if SMP)


              ’b’ – Bold hilite      On  (not ’reverse’)

            * ’c’ – Command line     Off (name, not cmd line)

            * ’H’ – Threads          Off (show all threads)

            * ’i’ – Idle tasks       On  (show all tasks)

              ’R’ – Reverse sort     On  (pids high-to-low)

            * ’S’ – Cumulative time  Off (no, dead children)

              ’x’ – Column hilite    Off (no, sort field)

              ’y’ – Row hilite       On  (yes, running tasks)

              ’z’ – colour/mono       Off (no, colours)




       The command-line syntax for top consists of:

       a: Sort by memory usage

            This switch makes top to sort the processes by allocated memory

       b : Batch mode operation

            Starts top in ’Batch mode’, which could be useful for sending output from the top to other programs or to a file.  In this mode, the top will not accept input and runs until the iterations limit you’ve set with the ’-n’ command-line option or until killed.

       c: Command line/Program name toggle

            Starts top with the last remembered ’c’ state reversed.  Thus, if the top was displaying command lines, now that field will show program names, and visa versa. 

       d: Delay time interval as:  -d ss. tt (seconds.tenths)

            Specifies the delay between screen updates, and overrides the corresponding value in one’s personal configuration file or the startup default.  Later this can be changed with the ’d’ or ’s’              interactive commands.

       h: Help

            Show the library version and the usage prompt, then quit.

       H: Threads toggle

            Starts top with the last remembered ’H’ state reversed.  When this toggle is On, all individual threads will be displayed.  Otherwise, the top displays a summation of all threads in a process.

       i: Idle Processes toggle

            Starts top with the last remembered ’i’ state reversed.  When this toggle is Off, tasks that are idled or zombied will not be displayed.

       m: VIRT/USED toggle

            Reports USED (sum of process rss and swap total count) instead of VIRT

       M: Detect memory units

            Show memory units (k/M/G) and display floating point values in the memory summary.

       n : Number of iterations limit as:  -n number

            Specifies the maximum number of iterations, or frames, the top should produce before ending.

       p : Monitor PIDs as:  -pN1 -pN2   or  -pN1, N2 [,…]

            Monitor only processes with specified process IDs.  This option can be given up to 20 times, or you can provide a comma-delimited list with up to 20 pids. 

       s: Secure mode operation

            Starts top with secure mode forced, even for root.  This mode is far better controlled through the system configuration file.

       S: Cumulative time mode toggle

            Starts top with the last remembered ’S’ state reversed.  When ’Cumulative mode is On, each process is listed with the CPU time that it and its dead children have used.

       u: Monitor by the user as:  -u somebody

            Monitor only processes with an effective UID or user name matching that given.

       U: Monitor by the user as:  -U somebody

            Monitor only processes with a UID or user name matching that given.  This matches real, effective, saved, and filesystem UIDs.

       v: Version

            Show the library version and the usage prompt, then quit.

DESCRIPTIONS of Fields or Columns:

Listed below are the top available fields.  They are always associated with the letter shown, regardless of the position you may have established for them with the ’o’ (Order fields) interactive command.

Any field is selectable as the sort field, and you control whether they are sorted high-to-low or low-to-high.

       a: PID    Process Id

          The task’s unique process ID, which periodically wraps, though never restarting at zero.

       b: PPID    Parent Process Pid

          The process ID of a task’s parent.

       c: RUSER    Real User Name

          The real user name of the task’s owner.

       d: UID    User Id

          The effective user ID of the task’s owner.

       e: USER    User Name

          The effective user name of the task’s owner.

       f: GROUP    Group Name

          The effective group name of the task’s owner.

       g: TTY    Controlling Tty

          The name of the controlling terminal.  This is usually the device (serial port, pty, etc.) from which the process was started, and which it uses for input or output.

       h: PR    Priority

          The priority of the task.

       i: NI    Nice value

          The nice value of the task.  A negative nice value means higher priority, whereas a positive nice value means lower priority.  

       j: P    Last used CPU (SMP)

          A  number representing the last used processor.  In a true SMP environment, this will likely change frequently since the kernel intentionally uses weak affinity. 

       k: %CPU    CPU usage

          The task’s share of the elapsed CPU time since the last screen update is expressed as a percentage of total CPU time.

       l: TIME    CPU Time

          Total CPU time the task has used since it started.  When ’Cumulative mode is On, each process is listed with the CPU time that it and its dead children have used.

       m: TIME+    CPU Time, hundredths

          The same as ’TIME’, but reflecting more granularity through hundredths of a second.

       n: %MEM    Memory usage (RES)

          A task’s currently used share of available physical memory.

       o: VIRT    Virtual Image (kb)

          The total amount of virtual memory used by the task.  It includes all code, data and shared libraries plus pages that have been swapped out.

       p: SWAP    Swapped size (kb)

           Swap usage: total size of swap areas, amount of swap space in use and amount of swap space available.

       q: RES    Resident size (kb)

          The non-swapped physical memory a task has used.

          RES = CODE + DATA.

       r: CODE    Code size (kb)

          The amount of physical memory devoted to executable code.

       s: DATA    Data+Stack size (kb)

          The amount of physical memory devoted to other than executable code.

       t: SHR    Shared Mem size (kb)

          The amount of shared memory used by a task.  It simply reflects memory that could be potentially shared with other processes.

       u: nFLT    Page Fault count

          The number  of major page faults that have occurred for a task.  A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space.  A major page fault is when disk access is involved in making that page available.

       v: nDRT    Dirty Pages count

          The number of pages that have been modified since they were last written to disk.  Dirty pages must be written to disk before the corresponding physical memory location can be used for some other virtual page.

       w: S    Process Status

          The status of the task can be one of:

             D’ = uninterruptible sleep

             R’ = running

             S’ = sleeping

             T’ = traced or stopped

             Z’ = zombie

       x: Command    Command line or Program name

          Display the command line used to start a task or the name of the associated program.  You toggle between the command line and name with ’c’, which is both a command-line option and an interactive command.

       y: WCHAN    Sleeping in Function

       z: Flags    Task Flags



The Top command in Linux is a powerful tool for real-time process monitoring and system management. By providing valuable insights into resource utilization and process statistics, it empowers users to optimize system performance, troubleshoot issues, and make informed decisions. Understanding how to effectively use the Top command is essential for anyone working with Linux systems.

So, the next time you find yourself needing to monitor your Linux system’s processes, remember the Top command and leverage its capabilities to ensure optimal performance and efficiency.


Frequently Asked Questions (FAQs)

Q: How can I terminate a process using the Top command?

To terminate a process using the Top command, follow these steps:

  1. Launch the Top command by typing top in the terminal.
  2. Identify the process you want to terminate from the process table.
  3. Press the k key to enter the process kill menu.
  4. Enter the process ID (PID) of the target process and press Enter.
  5. Confirm the termination by pressing y.

Q: Can I change the update interval in the Top command interface?

Yes, you can change the update interval in the Top command interface. While the Top command is running, you can press the d key to modify the update interval. Enter the desired interval (in seconds) and press Enter to apply the change.

Q: How can I monitor a specific user’s processes with the Top command?

To monitor processes for a specific user using the Top command, use the following steps:

  1. Launch the Top command by typing top in the terminal.
  2. Press the u key to enter the user filter menu.
  3. Enter the username of the target user and press Enter.
  4. The process table will now display only the processes associated with the specified user.

Q: Is the Top command available on all Linux distributions?

Yes, the Top command is available on most Linux distributions by default. However, if the command is not installed on your system, you can typically install it using your package manager. For example, on Ubuntu-based distributions, you can install the Top command by running sudo apt install procps.

Q: Can I save the output of the Top command to a file?

Yes, you can save the output of the Top command to a file for future reference or analysis. While the Top command is running, you can press the W key to write the current configuration and process table to a file. Enter the filename and press Enter to save the output.

Q: Are there any alternatives to the Top command in Linux?

Yes, there are several alternatives to the Top command in Linux, such as htop, glances, and atop. These alternatives provide additional features and more advanced interfaces for process monitoring and system management.


3 thoughts on “2023 What Is Top Command In Linux : An In-Depth Guide for the BEST system admins”

  1. Pingback: [2023] Netstat Command To Check Port : A Powerful Tool In A Network Admin's Arsenal. | TechSwankk

  2. Pingback: Docker Commands Cheat Sheet : The Top 30 Commands |

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top