Find what is loading the CPU
Open top, press P (sort by CPU) and c (full command line). The top row of the
table is the main consumer. %CPU over 100 means the process is using several cores.
top — processes and load in real time
The top program refreshes the process list, CPU load, memory and load average every few seconds.
Cheat sheet
6 commands Printable version-
topa live process list; q to quit -
top -o %MEMsorted by memory from the start -
top -u studentone user's processes -
top -p 1234,1240only these PIDs -
top -d 5refresh every 5 seconds -
top -b -n 1 | head -n 15one plain-text snapshot — for a report - inside: P — by CPU, M — by memory, 1 — per core, c — full
- command, k — send a signal, h — help, q — quit
Overview
top is ps that doesn't stop: every three seconds it redraws the screen. At the
top is a summary of the machine, below is the process table, with the hungriest by
CPU at the top by default.
| Summary line | What to look at |
|---|---|
load average |
the average CPU queue over 1, 5 and 15 minutes; compare with the core count (nproc) |
Tasks |
how many processes, and whether there are zombie ones |
%Cpu(s) |
us — programs, sy — kernel, id — idle, wa — waiting on disk, st — taken by the hypervisor |
MiB Mem |
total, free, used, buff/cache — file cache the kernel gives back when needed |
MiB Swap |
avail Mem — how much memory programs can really get |
Table columns: PID, USER, PR and NI — priority; VIRT, RES, SHR — memory
in KiB (RES is what's actually used); S — state (like STAT in ps); %CPU,
%MEM; TIME+ — accumulated CPU time; COMMAND.
Options
7Most settings are easier to change with keys inside top; startup options are for
scripts and snapshots. Full list — man top.
| Option | What it does | Example |
|---|---|---|
-o field |
Sort by a column — %CPU, %MEM, TIME+. | top -o %MEM |
-u user |
Show only this user's processes. | top -u student |
-p PID |
Watch only these PIDs (comma-separated). | top -p 1234,1240 |
-d seconds |
Refresh interval in seconds. | top -d 5 |
-b |
Batch mode — plain text for a file or a pipe. | top -b -n 1 |
-n N |
Exit after N refreshes. | top -b -n 3 -d 2 |
-H |
Show threads, not just processes. | top -H -p 1234 |
Nothing found. Try a shorter query.
Recipes
5Find what ate the memory
Press M to sort by %MEM. Look at RES, not VIRT: VIRT includes memory that is
reserved but not used. What to do next — memory-swap.
Stop a process right from top
Press k, enter the PID (the top process is offered by default) and a signal: Enter
sends 15 (SIGTERM). More on signals — kill.
A snapshot for a report or ticket
-b (batch) prints plain text without redrawing the screen; -n 1 takes one
snapshot.
htop
htop is the same idea with color, mouse and scrolling. If it's installed, the keys
are labeled at the bottom: F6 — sort, F9 — signal, F10 — quit.
Troubleshooting
5Load average is high, but the CPU is nearly idle
The queue holds processes in state D waiting on the disk. Check wa in the
%Cpu(s) line and processes with S = D. Step-by-step analysis —
system-monitoring.
free is almost zero — out of memory?
No, if buff/cache and avail Mem are large: Linux keeps spare memory as file cache
and hands it to programs on demand. The warning signs are a small avail Mem and a
growing used in Swap.
A process shows 150 %CPU
The percentage is per core: a multithreaded program on several cores goes over 100.
The 1 key shows each core's load separately.
How to quit top
q. If top is waiting for input (after k, o or u), press Esc first.
Garbage and terminal codes when piping
Without -b, top draws the screen with control codes. For > file and | grep
always use top -b -n 1.
See also
- ps — a single snapshot of processes with any columns.
- kill — end a process you found in top.
- processes — states, signals, priorities.
- system-monitoring — "the server is slow", step by step.
- memory-swap — how to read memory and swap.
- uptime-who — load average in one line.
Found an inaccuracy? Report an error in the article