top Command in Linux: Monitor Processes and Resource Usage

The top command in Linux provides a real-time view of running processes and system resource usage. From a single interactive screen you can check CPU load, memory consumption, load averages, and process activity all at once.

How to Use the top Command in Linux

Run top without arguments to start the interactive monitor:

bashtop

The display splits into two areas:

• Summary area — system-wide metrics across the top header lines
• Task area — per-process rows listed below

The %Cpu(s) line is where most performance diagnosis starts. It breaks CPU time into labeled categories:

• us — user-space processes (your applications)
• sy — kernel processes
• ni — user-space processes running with an adjusted nice value
• id — idle time
• wa — waiting for I/O; high wa means the disk or network is the bottleneck, not the CPU
• hi / si — hardware and software interrupt handling
• st — CPU time stolen by the hypervisor; only meaningful on virtual machines

Load average appears on the first header line as three numbers covering the 1, 5, and 15-minute windows. These represent the average number of runnable or uninterruptible tasks. Compare them to your CPU core count — a load average of 4.0 on a 4-core machine means the system is fully saturated.

Reading the Task Area: Memory Columns and Process State

The three memory columns are the source of the most confusion:

• VIRT — the total virtual address space the process has mapped. This includes shared libraries and memory-mapped files, not all of which are resident in RAM
• RES — the actual physical RAM the process is using right now
• SHR — the portion of RES that is shared with other processes (shared libraries, for example)

The memory used exclusively by a process is RES minus SHR. Shared libraries show up in RES for every process that uses them, so summing RES across all processes overstates actual memory consumption.

Process states appear in the S column: R (running), S (sleeping), D (uninterruptible sleep — waiting on I/O at the kernel level and cannot be killed normally), Z (zombie).

A zombie process has finished execution but stays in the process table because its parent has not read the exit status. A handful of zombies is harmless. A steadily growing count points to a bug in the parent process.

Interactive Keys, Filters, and Batch Mode

Press these keys while top is running:

Key	Action
P	Sort by CPU usage
M	Sort by memory usage
1	Toggle per-CPU core display
u	Filter by user
k	Kill a process by PID
r	Renice a process
c	Toggle full command line
q	Quit

Press 1 to break the aggregate CPU line into individual cores. This is the most reliable way to catch a single thread pinning one core while the overall %Cpu still looks acceptable.

Command-line filters let you focus the display before it opens:

bashtop -u www-data      # show only one user's processestop -p 1234,5678     # monitor specific PIDstop -d 5             # refresh every 5 secondstop -H               # show individual threads instead of processes

Batch mode turns top into a scriptable snapshot tool by removing the interactive display entirely:

bashtop -b -n 1 > top.txt                   # single snapshot to a filetop -b -n 5 -d 1 > top-snapshots.txt   # 5 snapshots at 1-second intervals

-b makes top safe for cron jobs, log collection, and automation pipelines where an interactive terminal is not available.

Learn the P, M, and 1 keys for everyday interactive use, and reach for -b -n 1 when you need a point-in-time snapshot for a script or log. Leave a comment below if you run into any issues.