The top Command in Linux: A Complete Guide to System Monitoring

Introduction / Why This Matters

The top command is a fundamental, always-available tool for quick, real-time system monitoring in Linux. Unlike graphical task managers, top runs directly in the terminal and shows which processes consume the most resources (CPU, memory), overall system load, and system uptime. Mastering top is critical for system administrators, developers, and anyone who works with servers or wants to understand why their computer has become slow.

After completing this guide, you will be able to:

• Read and understand top's output.
• Find resource-hogging processes.
• Filter and sort processes by specific criteria.
• Manage processes (change priority, terminate) directly from the interface.
• Customize the display for your specific tasks.

Requirements / Preparation

1. Access to a Linux terminal (locally or via SSH).
2. The top command is preinstalled on almost all distributions as part of the procps-ng or procps package. If it's missing (unlikely), install it:
   • Debian/Ubuntu: sudo apt update && sudo apt install procps
   • RHEL/CentOS/Fedora: sudo yum install procps-ng or sudo dnf install procps-ng
3. Permissions: To view all processes (including system ones), you typically need root privileges (sudo top). Managing processes not owned by your user also requires elevated privileges.
4. Basic understanding of what a process is (PID), CPU usage, and memory (RAM/Swap).

Step-by-Step Guide

Step 1: Run top and Understand the Interface

Type top in the terminal and press Enter.

top

You will see a screen divided into two main areas:

1. Upper part (Summary Area) — system summary:
   • top — line with version, system uptime (up), number of users (users), and load average (1, 5, 15 min).
   • Tasks: — total number of processes and their states (running, sleeping, stopped, zombie).
   • %Cpu(s): — CPU utilization: us (user), sy (system), ni (nice), id (idle), wa (wait/I/O), hi (hardware IRQ), si (software IRQ), st (steal time — for virtualization).
   • KiB Mem: and KiB Swap: — RAM and swap file/partition usage (total, used, free, buff/cache).
2. Lower part (Processes Area) — list of processes (sorted by %CPU by default). Key columns:
   • PID — process identifier.
   • USER — process owner.
   • %CPU — CPU share used by this process.
   • %MEM — share of physical memory used.
   • TIME+ — total CPU time used since the process started.
   • COMMAND — command/process name.

💡 Tip: Press h or ? at any time to see help for all interactive commands.

Step 2: Master Basic Control and Sorting

top is an interactive program. Control is done with single key presses.

• Sorting (most common operation):
  • P — sort by %CPU (default).
  • M — sort by %MEM.
  • N — sort by PID (ascending).
  • T — sort by TIME+ (CPU time).
• Filtering (show only what you need):
  • Press O (capital O). A field for entering a condition will appear.
  • To show only processes for user nginx, enter: USER=nginx and press Enter.
  • To show processes where %CPU exceeds 5.0, enter: %CPU>5.0.
  • To reset the filter, press O, enter =, and press Enter.
• Changing displayed fields:
  • Press f. You will enter the field selection menu.
  • Use up/down arrows to navigate the list.
  • Space — select/deselect a field (marked with * will be shown).
  • To the right of selected fields, you can change their order (arrows <- and ->).
  • Done? Press Enter, then q to exit the menu.

Step 3: Manage Processes Directly from top

This is one of the most powerful features.

• Terminate (kill) a process:
  1. Note the PID of the target process (or find it via filter).
  2. Press k.
  3. Enter the PID and press Enter.
  4. Enter the signal number (default 15 — SIGTERM, graceful termination). For forceful termination, use 9 (SIGKILL). Press Enter.

  ⚠️ Important: Signal 9 (SIGKILL) does not allow the process to shut down gracefully and save data. Use only if SIGTERM fails.

• Change a process's priority (nice):
  1. Press r.
  2. Enter the process PID.
  3. Enter the new nice value (from -20 — highest priority, to 19 — lowest). Usually, you increase nice (lower priority) for background tasks to avoid interfering with interactive ones.
  4. Press Enter.

Step 4: Customize the Interface and Use Useful Hotkeys

• z — toggle color highlighting (very helpful for visually distinguishing active processes).
• x — highlight the column used for sorting (highlighted by default).
• b — toggle bold text/color for active (CPU-using) processes.
• u — quickly filter processes by username (enter name or leave empty for all).
• V — switch to process tree view (forest view) to see hierarchy (parent/child processes). Very useful for understanding which daemon spawned which process.
• c — toggle command display: full path and arguments (/usr/bin/python3 script.py) or just the command name (python3).
• Space — immediately refresh the screen (if paused).
• s — change the screen refresh delay (in seconds, default 3.0). Enter a smaller value for more frequent updates.
• q — exit top.

Verification Checklist

You have successfully mastered top if you can:

1. Within 10 seconds, find the process with the highest %CPU and %MEM without using a mouse.
2. Filter the list to show only processes for user postgres (or any other user).
3. See the tree of child processes for systemd or sshd.
4. Correctly terminate a test process (e.g., started with sleep 1000) using k and signal 15.
5. Save a static snapshot of system state with the command top -b -n 1 > system_snapshot.txt and confirm the file was created and contains readable text.

Common Issues & Solutions

• I don't see all processes / processes from another user.
  • Cause: Insufficient permissions.
  • Solution: Run top with sudo: sudo top. Be careful when managing root-owned processes.
• Processes with low %CPU are not displayed, even though there are many.
  • Cause: By default, top shows only active processes (with non-zero %CPU or %MEM) or limits the number of rows for the list. A filter might also be active.
  • Solution: Press f and ensure fields like A (VIRT) aren't hiding processes. Reset the filter (O → =). Increase the number of displayed rows (settings may vary by version).
• I can't find a process by name (e.g., nginx).
  • Cause: The COMMAND column may show only the binary name (nginx), not the full command line. Or the process might be in state D (uninterruptible sleep, often due to I/O) and not accumulating %CPU.
  • Solution: Use a filter on COMMAND (O → COMMAND=nginx). Or press c to switch to full command line display. To find "sleeping" processes, sort by TIME+ or use the more flexible ps aux | grep nginx.
• top doesn't show process network activity.
  • Cause: Standard top lacks built-in fields for network statistics (in/out).
  • Solution: For network monitoring, use separate tools: nethogs, iftop, ss -tuna, or netstat -tunap. Some top versions (e.g., from procps-ng on RHEL) may have limited support for network stats fields (n), but this is non-standard.
• I can't exit top; I pressed a random key and the interface is broken.
  • Solution: Press q to exit. If that doesn't work, try Ctrl+C. As a last resort, close the terminal or SSH window.
• I want a more visually appealing interface.
  • Solution: Install htop (sudo apt install htop or sudo yum install htop). It's a full-featured top replacement with mouse support, colors, and convenient navigation.