top is an interactive command-line monitor that displays a continuously refreshed view of running processes and overall resource usage on Linux. In Linux monitoring, it is the first tool administrators open when a system feels slow: within one screen it shows load averages, CPU time split by category, memory and swap usage, and a sortable process table that reveals which programs consume the most resources.
The version found on almost every Linux distribution comes from the procps-ng package and reads its data from the /proc file system. It refreshes every 3 seconds by default, requires no configuration and runs on minimal servers where graphical or web-based tools are unavailable.
How top gathers and displays data
At each refresh, top reads /proc/stat for CPU counters, /proc/meminfo for memory, /proc/loadavg for load and the files under /proc/PID/ for every process. CPU percentages are computed as differences between two samples, which is why the first screen after startup can be less accurate than later ones.
The display has two parts: a summary area of five lines and a task area with one row per process or thread.
| Line | Content | What to look for |
|---|---|---|
| Uptime and load | Time running, users, 1-, 5- and 15-minute load | Load well above the number of CPUs |
| Tasks | Total, running, sleeping, stopped, zombie | Growing zombie or running counts |
| CPU states | us, sy, ni, id, wa, hi, si, st | High wa, sy or st values |
| Memory | Total, free, used, buff/cache in MiB | Low available memory, not low free |
| Swap | Total, free, used, avail Mem | Swap use rising over time |
Reading CPU states and load averages
The CPU line splits processor time into eight categories. Interpreting them correctly separates a CPU shortage from a storage or virtualization problem.
| Field | Meaning | High values suggest |
|---|---|---|
| us | User-space code at normal priority | Busy applications |
| sy | Kernel code | Heavy system calls, networking or locking |
| ni | User code with a positive nice value | Background jobs running at low priority |
| id | Idle time | Spare capacity |
| wa | Idle while waiting for I/O | Slow or saturated storage |
| hi / si | Hardware and software interrupts | High network or device interrupt load |
| st | Time stolen by the hypervisor | Overcommitted virtualization host |
The load average counts tasks that are running, runnable or in uninterruptible sleep, usually waiting for disk. A load of 8 on an 8-core machine means full use without queuing, while the same load on 2 cores means tasks are waiting. Because Linux includes I/O waits, a high load with idle CPUs often points to storage rather than processing.
In the task area, %CPU is relative to one core, so a multithreaded process can show 400 percent on a four-core system. Pressing Shift+I toggles Irix mode; with it turned off, top divides the value by the number of CPUs.
Memory columns and interactive commands
Memory figures are the most misread part of top. VIRT includes all mapped address space, even unused reservations, and is rarely meaningful alone. RES is the resident memory actually in RAM, and SHR is the part of RES that may be shared with other processes, such as libraries.
In the summary, avail Mem estimates how much memory can be given to new work without swapping, including reclaimable cache. A low free value with a high buff/cache value is normal and healthy, because Linux uses spare memory for caching.
| Key | Action |
|---|---|
| P / M / T | Sort by CPU, memory or cumulative time |
| 1 | Show each CPU separately |
| H | Show individual threads |
| c | Show the full command line |
| k / r | Kill or renice a process |
| f | Choose and reorder columns |
| u | Filter by user |
| W | Save the current layout to the configuration file |
For scripts and logs, batch mode writes plain text instead of an interactive screen. The command top -b -n 1 -o %MEM | head -20 captures a single snapshot of the twenty largest memory users.
top compared with other monitoring tools
Linux monitoring tools overlap, but each answers a different question. top gives a broad first impression, and specialized tools explain what top only hints at.
| Tool | Main question answered | Strength |
|---|---|---|
| top | Which processes use CPU and memory now | Available everywhere, low overhead |
| htop | Same, with easier navigation | Color bars, mouse, tree view |
| vmstat | How memory, swap and CPU behave over time | Compact periodic samples |
| iostat | Which disks are busy and how fast | Per-device latency and utilization |
| strace | What system calls one process makes | Explains a stuck or slow process |
| Pressure stall information | How long tasks wait for CPU, memory or I/O | Direct measure of contention |
Limitations and common misinterpretations
top shows a short sampling window, so it can miss short-lived processes and brief spikes that start and finish between refreshes. Tools that record history or trace process creation are needed for those cases.
- Low free memory alone is not a problem; check avail Mem and swap activity instead.
- A high load average does not prove CPU shortage; check wa and disk metrics.
- Inside containers, top may show host-wide totals rather than the container limits set by cgroups.
- Very short refresh intervals such as
-d 0.1add measurable overhead on systems with thousands of processes. - Zombie processes use no resources themselves; the parent that does not reap them is the real issue.
A plain-language summary
top is a live scoreboard for a Linux computer. It lists every running program and shows how much of the processor and memory each one is using, updating every few seconds.
When a machine becomes slow, opening top is like looking at a busy kitchen to see which cook is overloaded. The most demanding programs rise to the top of the list, so the cause of a slowdown is usually visible at a glance.
An example from practice
Users report that an internal application server has become sluggish. The on-call engineer connects over SSH and runs top. The load average reads 14 on an 8-core machine, but the CPU line shows only 20 percent user time and 45 percent wa, which points away from computation and toward storage.
Pressing M sorts by memory and shows nothing unusual, while pressing P shows a backup agent at the top of the list with several threads in state D, meaning uninterruptible disk wait. The engineer confirms the diagnosis with iostat, which shows the data disk at near 100 percent utilization. Rescheduling the backup to the night window restores normal response times within minutes.