Linux Top Command Output Explained

The top program offers a convenient interface in which you can monitor current process activity and also perform some basic management tasks.  below Figure shows what a top window looks like.

 

In the upper five lines of the top interface, you can see information about the current system activity. The lower part of the top window shows a list of the most active processes at the moment. This window is refreshed every fi ve seconds. If you notice that a process is very busy, you can press the k key from within the top interface to terminate that process.

The top program will first ask for the PID of the process to which you want to send a signal (PID to kill). After you enter this, it will ask which signal you want to send to that PID, and then it will immediately operate on the requested PID.
In the upper five lines of the top screen, you’ll fi nd a status indicator of current system performance. The most important information you’ll find in the first line is the load average. This gives the load average of the last minute, the last 5 minutes, and the last 15 minutes.

To understand the load average parameter, you should know that it reflects the average number of processes in the run queue, which is the queue where processes wait before they can be handled by the scheduler. The scheduler is the kernel component that makes sure that a process is handled by any of the CPU cores in your server. One rough estimate of whether your system can handle the workload is that the number of processes waiting in the run queue should never be higher than the total number of CPU cores in your server.

Tip: A quick way to find out how many CPU cores are in your server is by pressing the 1 key from the top interface. This will show you one line for every CPU core in your server.

In the second line of the top window, you’ll see how many tasks your server is currently handling and what each of these tasks is doing. In this line, you may find four status indications.

running: The number of active processes in the last polling loop.
sleeping: The number of processes currently loaded in memory, which haven’t issued any activity in the last polling loop.
stopped: The number of processes that have been sent a stop signal but haven’t yet freed all of the resources they were using.
zombie: The number of processes that are in a zombie state. This is an unmanageable process state because the parent of the zombie process has disappeared and the child still exists but cannot no longer be managed because the parent is needed to manage that process.A zombie process normally is the result of bad programming. If you’re lucky, zombie processes will go away by themselves. Sometimes they don’t, and that can be an annoyance. In that case, the only way to clean up your current zombie processes is by rebooting your server.

 

In the CPU(s) line, you’ll find the following information about CPU states:

us : The percentage of time your system is spending in user space, which is the amount of time your system is handling user-related tasks.
sy : The percentage of time your system is working on kernel-related tasks in system space. On average, this should be (much) lower than the amount of time spent in user space.
ni : The amount of time your system has worked on handling tasks of which the nice value has been changed
id : The amount of time the CPU has been idle.
wa : The amount of time the CPU has been waiting for I/O requests. This is a very common indicator of performance problems. If you see an elevated value here, you can make your system faster by optimizing disk performance.
hi : The amount of time the CPU has been handling hardware interrupts.
si : The amount of time the CPU has been handling software interrupts.
st : The amount of time that has been stolen from this CPU. You’ll see this only if your server is a virtualization hypervisor host, and this value will increase at the moment that a virtual machine running on this host requests more CPU cycles.

You’ll find current information about memory usage in the last two lines of the top status. The first line contains information about memory usage, and the second line has information about the usage of swap space. The formatting is not ideal, though. The last item on the second line provides information that is really about the usage of memory.

The following parameters show how memory currently is used:
Mem : The total amount of memory that is available to the Linux kernel.
used : The total amount of memory that currently is used.
free :The total amount of memory that is available for starting new processes.
buffers : The amount of memory that is used for buffers. In buffers, essential system tables are stored in memory, as well as data that still has to be committed to disk.
cached : The amount of memory that is currently used for cache.

 

In the Mem: section we have:

total: the amount of physical RAM in your machine
used: how much memory is being consumed by Linux, not just the sum of the processes.
free: How much RAM is not being consumed by Linux. This does not take into account that cached and buffered memory is in essence “free”.
buffers: buffer space is where blocks of disk I/O having been read or pending a write are stored. A buffer is a RAM representation of a single disk block.

In the Swap: section we have:

total: Amount of disk space available to swap pages to.
used: How much disk swap space is used.
free:  How much disk swap space is free.
cache: Closely related to buffers above. It’s actually part of the page cache and itself has no space on physical disk.

The Linux kernel tries to use system memory as efficiently as possible. To accomplish this goal, the kernel caches a lot. When a user requests a file from disk, it is first read from disk and then copied to RAM. Fetching a file from disk is an extremely slow process compared to fetching the file from RAM. For that reason, once the file is copied in RAM, the kernel tries to keep it there as long as possible. This process is referred to as caching. From top, you can see the amount of RAM that is currently used for caching of data.
You’ll notice that the longer your server is up, the more memory is allocated to cache. This is good because the alternative to using memory for caching would be to do nothing at all with it.

When the kernel needs memory that currently is allocated to cache for something else, it can claim this memory back immediately.The memory in buffers is related to cache. The kernel caches tables and indexes that it needs in order to allocate files and caches data that still has to be committed to disk in buffers. Like cache, buffer memory can also be claimed back immediately by the kernel when needed.

The rest of the lines display all the active processes on the system, sorted default by CPU usage (%CPU column). i.e the most CPU intensive processes will be displayed on the top by default.

 

And finally the Processes list Rows

PID – l’ID of the process(1)
USER – The user that is the owner of the process (root)
PR – priority of the process (20)
NI – The “NICE” value of the process (0)
VIRT – virtual memory used by the process (19396)
RES – physical memory used from the process (1560)
SHR – shared memory of the process (1252)
S – indicates the status of the process: S=sleep R=running Z=zombie (S)
%CPU – This is the percentage of CPU used by this process (0.0)
%MEM – This is the percentage of RAM used by the process (0.0)
TIME+ –This is the total time of activity of this process (0:00.92)
COMMAND – And this is the name of the process (init)

 

Tips and Tricks:

How to identify the most memory intensive processes?

While the output of the top command displayed, press F, which will display the following message and show all fields available for sorting, press n (which is for sorting the processes by Memory) and press enter. This will display the processes in the top output sorted by memory usage.

Current Sort Field:  K  for window 1:Def

How to add additional fields (for e.g. CPU Time) to the top output?

While the top command is running, press f, which will display the following message and show all fields available for display, press l, which will add the CPU Time to the display columns in the top output.

Current Fields:  AEHIOQTWKNMbcdfgjplrsuvyzX  for window 1:Def

How to get the full path name and parameters of the running processes?

While the top command is running, press c, which will display full pathname of running processes.

What are the basic differences between VIRT, RES and SHR?

VIRT stands for the virtual size of a process, which is the sum of memory it is actually using, memory it has mapped into itself (for instance the video card’s RAM for the X server), files on disk that have been mapped into it (most notably shared libraries), and memory shared with other processes. VIRT represents how much memory the program is able to access at the present moment.
RES stands for the resident size, which is an accurate representation of how much actual physical memory a process is consuming. (This also corresponds directly to the %MEM column.) This will virtually always be less than the VIRT size, since most programs depend on the C library.
SHR indicates how much of the VIRT size is actually sharable (memory or libraries). In the case of libraries, it does not necessarily mean that the entire library is resident. For example, if a program only uses a few functions in a library, the whole library is mapped and will be counted in VIRT and SHR, but only the parts of the library file containing the functions being used will actually be loaded in and be counted under RES.

How to display a Specific User Process?

Use top command with ‘u‘ option will display specific User process details.
# top -u techpaste

Highlight Running Process in Top

Press ‘z‘ option in running top command will display running process in color which may help you to identified running process easily.