The top Command — System Resource Monitoring

Overview

top is a real-time system monitoring tool that displays a live, updating view of running processes along with CPU, memory, and load average statistics. It’s the first tool to reach for when investigating server performance issues.

Starting top

top

Press q to quit, or Ctrl+C.

Understanding the Output

Header Section

top - 14:32:01 up 45 days,  3:12,  2 users,  load average: 0.52, 0.38, 0.41
Tasks: 142 total,   1 running, 140 sleeping,   0 stopped,   1 zombie
%Cpu(s):  5.2 us,  1.3 sy,  0.0 ni, 93.1 id,  0.3 wa,  0.0 hi,  0.1 si
MiB Mem :   7953.5 total,   2145.2 free,   3256.8 used,   2551.5 buff/cache
MiB Swap:   2048.0 total,   2048.0 free,      0.0 used.   4432.1 avail Mem

Line	Key Information
Load average	1-min, 5-min, 15-min averages. Values below your CPU count are healthy.
Tasks	Total, running, sleeping, stopped, and zombie processes
%Cpu	`us` = user, `sy` = system, `id` = idle, `wa` = I/O wait
Mem	Total, free, used, and buffer/cache memory
Swap	Swap space usage — high swap use indicates memory pressure

Process List Columns

Column	Description
PID	Process ID
USER	Owner of the process
PR	Priority
NI	Nice value (scheduling priority)
VIRT	Virtual memory used
RES	Resident (physical) memory used
SHR	Shared memory
S	Status: R (running), S (sleeping), Z (zombie)
%CPU	CPU usage percentage
%MEM	Memory usage percentage
TIME+	Total CPU time consumed
COMMAND	Command/process name

Interactive Keyboard Shortcuts

While top is running, you can press these keys:

Key	Action
`q`	Quit top
`M`	Sort by memory usage
`P`	Sort by CPU usage (default)
`T`	Sort by cumulative time
`N`	Sort by PID
`k`	Kill a process (prompts for PID)
`u`	Filter by a specific user
`c`	Toggle full command path display
`1`	Toggle per-CPU breakdown
`H`	Toggle thread display
`d`	Change refresh interval (default: 3 seconds)

Batch Mode for Scripts

Run top for a single snapshot (useful for logging):

top -bn1 | head -20

-b — Batch mode (non-interactive)
-n1 — One iteration only

Log resource usage over time

top -bn 60 -d 10 > /tmp/top-output.log

This captures 60 snapshots, 10 seconds apart.

htop — A Better Alternative

htop is an enhanced version of top with a color-coded, scrollable interface:

htop

Key advantages of htop:

Color-coded CPU, memory, and swap bars
Mouse-clickable interface
Easier process filtering and searching (press F3 or /)
Tree view of parent/child processes (press F5)
Built-in ability to kill processes directly

Install htop if it’s not available:

# Debian/Ubuntu
sudo apt install htop

# CentOS/RHEL
sudo yum install htop

Practical Hosting Examples

Identify a CPU-hogging process

Launch top, press P to sort by CPU, and note the process consuming the most resources.

Check if the server is swapping

Look at the Swap line in the header. If swap usage is high and increasing, the server is running low on physical memory.

Monitor a specific user’s processes

top -u username

Quick snapshot of resource usage

top -bn1 | head -5

Tips

A load average consistently above your CPU core count indicates the server is overloaded.
High wa (I/O wait) in the CPU line suggests disk bottlenecks — check for heavy database queries or disk-intensive processes.
If %MEM for a single process is very high, consider optimizing that application or upgrading your server’s RAM.
Use the 1 key to see individual CPU core usage — useful for detecting uneven load distribution.