top — Monitor Processes and System Load in Real Time
Practical guide to top — monitor CPU and memory load live, sort and filter interactively, kill processes and capture snapshots for scripts and logs.
top shows you in real time what your system is doing: a constantly refreshing view of system metrics alongside a process list sorted by CPU load. A single keystroke re-sorts by memory, filters by user or kills a runaway process. This guide walks you through the key invocations, the interactive keys and the batch mode for scripts and logs.
Basic Usage
top — Start top in interactive mode with default settings.
toptop -d SECONDS — Set the update interval in seconds (default: 3).
top -d 1top -n ITERATIONS — Exit after a specific number of updates.
top -n 5top -b — Batch mode — non-interactive, suitable for piping and logging.
top -b -n 1top -p PID — Monitor only specific processes by PID.
top -p 1234top -p PID1,PID2,PID3 — Monitor multiple specific processes.
top -p 1234,5678,9012top -u USER — Show only processes belonging to a specific user.
top -u www-datatop -H — Show individual threads instead of processes.
top -HInteractive Sorting
P — Sort by CPU usage (default).
M — Sort by memory usage (%MEM).
N — Sort by process ID.
T — Sort by cumulative CPU time.
R — Reverse the sort order.
< / > — Move sort column left/right.
Interactive Display
1 — Toggle individual CPU core display.
t — Cycle through CPU display modes (text, bar graph, off).
m — Cycle through memory display modes (text, bar graph, off).
l — Toggle load average/uptime line.
c — Toggle between command name and full command line.
V — Toggle forest/tree view (parent-child hierarchy).
H — Toggle thread display.
i — Toggle idle process display.
x — Highlight the current sort column.
b — Toggle bold/reverse for running processes.
z — Toggle color display.
e — Cycle memory units for process list (KB, MB, GB, TB).
E — Cycle memory units for summary area.
Interactive Filtering & Search
u — Filter by user. Enter username or UID.
o/O — Add a filter (e.g., COMMAND=nginx, %CPU>10, %MEM>5).
Ctrl+O — Show active filters.
= — Clear all filters for the current window.
L — Locate/search for a string in the process list.
& — Find next occurrence of the search string.
n — Set the maximum number of displayed processes.
Interactive Actions
k — Kill a process. Enter PID, then signal number (default: 15/SIGTERM).
r — Renice a process. Enter PID, then new nice value.
d / s — Change the update interval.
W — Write current settings to ~/.toprc.
q — Quit top.
h / ? — Show help.
Key Columns Explained
PID — Process ID.
USER — Process owner.
PR — Priority (20 = normal, <20 = higher, rt = real-time).
NI — Nice value (-20 to 19). Lower = higher priority.
VIRT — Virtual memory size (total address space, including shared libraries and mapped files).
RES — Resident memory — physical RAM actually used by the process.
SHR — Shared memory — RAM shared with other processes.
S — Process state: R=running, S=sleeping, D=disk wait, Z=zombie, T=stopped.
%CPU — CPU usage percentage (can exceed 100% on multi-core systems).
%MEM — Percentage of physical memory used.
TIME+ — Cumulative CPU time used (minutes:seconds.hundredths).
COMMAND — Command name or full command line.
Batch Mode & Scripting
top -bn1 | head -20 — Quick system overview: one snapshot, first 20 lines.
top -bn1 | head -20top -bn1 -o %MEM | head -15 — Top memory consumers in batch mode.
top -bn1 -o %MEM | head -15top -bn1 -o %CPU | head -15 — Top CPU consumers in batch mode.
top -bn1 -o %CPU | head -15top -b -n 60 -d 1 > top.log — Log 60 seconds of process data.
top -b -n 60 -d 1 > top.logtop -bn1 -u USER — Show all processes for a user (batch mode).
top -bn1 -u www-dataConclusion
top ships with virtually every Linux server and gives you a picture of the system load in seconds – for everyday work you rarely need more than P (by CPU), M (by memory), u (user filter) and the batch mode top -b -n 1 for scripts and logs. Always read the load average (1/5/15 minutes) relative to the number of CPU cores: a value of 4 is relaxed on an 8-core machine but clear overload on a single core. Be careful with the interactive actions k (kill) and r (renice) – they act directly on running processes and can take down services if you enter the wrong PID. If you want more comfort, colour and mouse support, reach for htop; for a plain snapshot without the live view, ps is the quieter choice. On macOS, top is a different program with its own syntax (e.g. top -o cpu for sorting).
Further Reading
- Wikipedia: top (software) – background and history of the process monitor
- man7.org: top(1) – complete reference of all options and interactive keys