System monitoring is an important aspect of any more-or-less advanced Linux user, because there comes a time when you want to know what is taking precious resources or simply how much it does take. And despite what some people think, this is not applicable only to server systems. Desktop applications go haywire too, and you find your system slowed down to a crawl because some “rogue” app decided to eat up all your memory. For enterprise users there are lots of potent free or commercial solutions for monitoring, but for the old-school Linux user and/or someone that prefers to keep it simple, there is always top(1). If you’re somewhat familiar with the command line, you will probably benefit more from this article, but that doesn’t mean GUI-centric users won’t.

Frequently used options

Command line options

• -d delay
  This option specifies delay in seconds between top’s updates
• -p pid
  Monitoring a specific PID ( process ID )
• -b <number>
  This is a batch mode usually used to log top’s output.
• -n iter
  Specifies a number of updates required. For example to log top’s single output this option can be combined with -b top -n 1 -b > top.log

top’s internal commands

• H or ?
  Displays top’s keystrokes help
• k
  Kill process. Top command will ask for a PID of a process to kill.
• r
  Change process priority same by functionality as renice command
• s
  Change update rate. This is in number of seconds: 1, 0.5 and etc.
• P
  This command sorts all displayed processes by CPU usage
• M
  Same as above but sorts by Memory usage
• q
  Quit from top

Using top

You might’ve noticed we said nothing about installing top. That’s because it’s usually already installed in your distribution, and it’s even to be found in a Gentoo minimal install. If you remember, top is not strange to us, as we mentioned it before, except now it’s gonna receive more attention and you will get more examples and real-life use cases. As before in our Linux commands series, our main inspiration source are the manual pages, and we recommend you take a look at’em too, as these series aren’t a substitute.

Actually, top can do more than just display a table of running processes. We will first concentrate on the CLI options, then what keys and options you can use in conjunction with the existing fields top displays, then we’ll go on with the other possible uses of top and, of course, examples.

Command-line options

The fact that we’re inspired from the manual page doesn’t mean we have to be as precise and technical as the manual. So, what we’ll do is take each option, explain it shortly and move on. As you’re probably used to from other applications, the -h flag will show you help information, namely exactly what we’ll talk about in this section. Curiously enough, the -v flag does the exact same thing, but that’s consistent with what most Linux command-line applications do. OK, so now we’ll get into the serious part. top doesn’t have many command-line options, but it compensates with a very customizable interface once started. The first option we’ll deal with is -b, which stands for batch, and is destined for advanced tasks, where output is to be sent to some file and then parsed by means of tools like awk, perl or shell scripts.

Before we go further, there is a little concept top makes intensive use of: toggling. There are binary-state options that can be toggled via command-line options. Binary state, if we managed to scare you, means that these options one can use to view various aspects of the system can only have two opposite values, hence the “binary” part. For example, the -c option toggles/reverses the last ‘c’-state used: either command or program name. This can be simply illustrated. If you start xterm from the command line, you can start it like this:

 $ xterm -cr white

Now that’s the command line, but the program name will still be xterm (oh, and by the way, xterm’s -cr option sets the cursor color). -d [seconds] is probably, at least from where I’m standing, one of the most used flags of top. It stands for delay and it sets the the “refresh rate” (dissimilar to monitors, mind you) of top. It accepts integers, fractions of seconds, but not negative numbers. If you enter a negative value, it will use the default value of five seconds. -H is another toggle option, and it will reverse the last option regarding threading, AKA display all threads or not. While this toggling stuff will appear weird at start, I bet you will get used to it and you’ll find it useful after reading through this article. -i toggles the “idle and zombie processes view”, -n [integer] controls the number of iterations of top (without this, top will run until you stop it with ‘q’ or ^C) and -u selects the effective user/UID to filter by, same as ps. -U does the same thing, but without the “effective” part, while -p [PID] filters by process ID, with the possibility to enter more than one PID, using comma separation, and exiting this mode is done by typing ‘=’. top offers a secure mode as well, applicable even to root, that can be enabled by the -s flag, and finally there is -S, but it’s use is better detailed when describing interactive mode, so we’ll tell you later about it.

Fields

If you haven’t used top already, it’s best to know that it offers a lot of fields, none of them mandatory, and what follows is a list of them and a short explanation of each. We will try to be as short as humanly possible, because there are lots of fields and the names are pretty self-explanatory. This where some knowledge of Linux/Unix systems comes in handy, because we won’t stop to explain terms like PID or TTY, just the ones that aren’t imediately obvious. So, the fields are: PID, PPID, RUSER, UID, USER, GROUP, TTY, PR (priority), NI (nice value), P (last used processor), %CPU, TIME, TIME+(a more precise TIME), %MEM, VIRT, SWAP, RES, CODE, DATA, SHR, nFLT(page fault count), nDRT(dirty pages count), S (process status–see -S), Command (command-line or program name–see above), WCHAN, Flags.

One can select fields through the ‘f’ key, and order them via the ‘o’ key, so one can see exactly the data that matters, and unclutter the screen at the same time. Before we move on to interactive commands, we have to take a sneak peek at the modes top can run in. The first mode is the default, and is named full screen mode . The other is the alternate mode, and it can be toggled with ‘A’, that is capital a, and what it displays will be revealed later. Of course, you are recommended to take some time to play with top and see what happens when you press a key or another. From here on in, we will let examples do the work for us, so if you want a list of the interactive commands, you guessed it, look at the manual page.

Examples

top -d 1

top -d 1 -b

top -d 1 -n 5

top -d 3 -u myusername

top -p 1,1234

top -s -d 1

top -d 3 -U myusername

top -d 1 -c

top -d 1 -H

top -d 1 -i 

top -d 1 -S

[enter] or [space]

[h] or [?]

[A]

[B]

[d] or [s]

[G]

[u]

[U]

[k]

[q]

[r]

[W]

[Z]

[l], [m].[t], [1]

[a] and [w]

Configuration files

The file is named toprc and can be found in /etc, for system-wide scenarios, or if you want to create a personal one, use [W] as explained above, then use that as an example for further alterations.

*nix systems compatibility

Short answer: never count on it. Long answer: read the system’s manual and expect that some things work as they do on Linux, other don’t work at all or with different options. Google helps if you need a comparison between various implementations of top on different Unix systems.

Conclusion

Over the years, I found top indispensable, either when working at home or at the office. It is a potent tool that can give you pertinent answers in short time, only if you take a bit of your time to learn using it to its’ full potential.