# top — Monitor Processes and System Load in Real Time > Practical guide to top — monitor CPU and memory load live, sort and filter interactively, kill processes and capture snapshots for scripts and logs. Source: https://www.jpkc.com/db/en/cheatsheets/shell-system/top/ top shows you in real time what your system is doing: a constantly refreshing view of system metrics alongside a process list sorted by CPU load. A single keystroke re-sorts by memory, filters by user or kills a runaway process. This guide walks you through the key invocations, the interactive keys and the batch mode for scripts and logs. ## Basic Usage `top` — Start top in interactive mode with default settings. ```bash top ``` `top -d SECONDS` — Set the update interval in seconds (default: 3). ```bash top -d 1 ``` `top -n ITERATIONS` — Exit after a specific number of updates. ```bash top -n 5 ``` `top -b` — Batch mode — non-interactive, suitable for piping and logging. ```bash top -b -n 1 ``` `top -p PID` — Monitor only specific processes by PID. ```bash top -p 1234 ``` `top -p PID1,PID2,PID3` — Monitor multiple specific processes. ```bash top -p 1234,5678,9012 ``` `top -u USER` — Show only processes belonging to a specific user. ```bash top -u www-data ``` `top -H` — Show individual threads instead of processes. ```bash top -H ``` ## Interactive Sorting `P` — Sort by CPU usage (default). `M` — Sort by memory usage (%MEM). `N` — Sort by process ID. `T` — Sort by cumulative CPU time. `R` — Reverse the sort order. `< / >` — Move sort column left/right. ## Interactive Display `1` — Toggle individual CPU core display. `t` — Cycle through CPU display modes (text, bar graph, off). `m` — Cycle through memory display modes (text, bar graph, off). `l` — Toggle load average/uptime line. `c` — Toggle between command name and full command line. `V` — Toggle forest/tree view (parent-child hierarchy). `H` — Toggle thread display. `i` — Toggle idle process display. `x` — Highlight the current sort column. `b` — Toggle bold/reverse for running processes. `z` — Toggle color display. `e` — Cycle memory units for process list (KB, MB, GB, TB). `E` — Cycle memory units for summary area. ## Interactive Filtering & Search `u` — Filter by user. Enter username or UID. `o/O` — Add a filter (e.g., COMMAND=nginx, %CPU>10, %MEM>5). `Ctrl+O` — Show active filters. `=` — Clear all filters for the current window. `L` — Locate/search for a string in the process list. `&` — Find next occurrence of the search string. `n` — Set the maximum number of displayed processes. ## Interactive Actions `k` — Kill a process. Enter PID, then signal number (default: 15/SIGTERM). `r` — Renice a process. Enter PID, then new nice value. `d / s` — Change the update interval. `W` — Write current settings to ~/.toprc. `q` — Quit top. `h / ?` — Show help. ## Key Columns Explained `PID` — Process ID. `USER` — Process owner. `PR` — Priority (20 = normal, <20 = higher, rt = real-time). `NI` — Nice value (-20 to 19). Lower = higher priority. `VIRT` — Virtual memory size (total address space, including shared libraries and mapped files). `RES` — Resident memory — physical RAM actually used by the process. `SHR` — Shared memory — RAM shared with other processes. `S` — Process state: R=running, S=sleeping, D=disk wait, Z=zombie, T=stopped. `%CPU` — CPU usage percentage (can exceed 100% on multi-core systems). `%MEM` — Percentage of physical memory used. `TIME+` — Cumulative CPU time used (minutes:seconds.hundredths). `COMMAND` — Command name or full command line. ## Batch Mode & Scripting `top -bn1 | head -20` — Quick system overview: one snapshot, first 20 lines. ```bash top -bn1 | head -20 ``` `top -bn1 -o %MEM | head -15` — Top memory consumers in batch mode. ```bash top -bn1 -o %MEM | head -15 ``` `top -bn1 -o %CPU | head -15` — Top CPU consumers in batch mode. ```bash top -bn1 -o %CPU | head -15 ``` `top -b -n 60 -d 1 > top.log` — Log 60 seconds of process data. ```bash top -b -n 60 -d 1 > top.log ``` `top -bn1 -u USER` — Show all processes for a user (batch mode). ```bash top -bn1 -u www-data ``` ## Conclusion top ships with virtually every Linux server and gives you a picture of the system load in seconds – for everyday work you rarely need more than `P` (by CPU), `M` (by memory), `u` (user filter) and the batch mode `top -b -n 1` for scripts and logs. Always read the load average (1/5/15 minutes) relative to the number of CPU cores: a value of 4 is relaxed on an 8-core machine but clear overload on a single core. Be careful with the interactive actions `k` (kill) and `r` (renice) – they act directly on running processes and can take down services if you enter the wrong PID. If you want more comfort, colour and mouse support, reach for `htop`; for a plain snapshot without the live view, `ps` is the quieter choice. On macOS, top is a different program with its own syntax (e.g. `top -o cpu` for sorting). ## Further Reading - [Wikipedia: top (software)](https://en.wikipedia.org/wiki/Top_(software)) – background and history of the process monitor - [man7.org: top(1)](https://man7.org/linux/man-pages/man1/top.1.html) – complete reference of all options and interactive keys ## Related Commands - [htop](https://www.jpkc.com/db/en/cheatsheets/shell-system/htop/) – more comfortable, colourful process monitor with mouse support - [ps](https://www.jpkc.com/db/en/cheatsheets/shell-system/ps/) – snapshot of running processes without a live view - [free](https://www.jpkc.com/db/en/cheatsheets/shell-system/free/) – memory and swap usage at a glance