Table of Contents

There are a lot of analysis programs for Linux. One of the most famous is the top program. The long-lived top is built into Linux, and derivatives of it are available for most other operating systems.

If you were to type whatis top the results would most likely tell you that it "displays Linux processes". A very simple description for a powerful analysis tool.

The top program does display Linux processes, but it also shows the percentage of CPU and RAM that each process uses. It does this dynamically—meaning, in real-time. It goes further in that you can terminate those processes. That's mainly what I use top for — the analysis and the termination of processes. However, top does more.

Not only is it powerful but it is also extremely efficient. It analyzes the resources used but uses few resources to do the job — in true Unix fashion.

Watch the video below for a 30-minute tutorial about top and/or read on for more information.


top Basics

Okay, we've established that top is definitely an awesome program. Let's get into the program itself a little bit.

To run top, simply open a terminal and type top. It will display results that are similar to the figure below.

Figure 1 - The top program

In this figure, we see that top is broken into two sections:

  • System Summary: This is above the yellow header. It currently contains five rows of information including CPU, RAM, and tasks. More on this section later.
  • List of processes: This is the yellow header and below. We'll focus on this to start.

In the figure, I am working as the dpro user account. You can see the process ID (PID) as well as the CPU and memory usage for each process, among other things.

Note that the process listed in the first row (PID 3812) uses 17.5% of the CPU. The rest are listed in descending order of CPU usage. Of course, that's just the default setting; you can modify this to your heart's content — sort by memory usage - by pressing M, PID - N, Time - T, and so on, and back to the CPU - P.

Try it! Open the top program and analyze your system. When you are finished, press q to quit and return to the terminal.
If for some reason top does not work, try running it from the full, typical path: /usr/bin/top.
To find out where it is stored, type whereis top.
If you like to listen to music while you read then I have two things to say:
1) It can be distracting...
2) Here are a few songs that come to mind... Tennessee Flat-Top Box, It's a Long Way to the Top, You're the Top, Top of the World... um, anyway...

top CPU usage

Let's go further. Look at another screen capture of the top program.

Figure 2 - top with COMMAND column path details (click to enlarge)

In this case, we see that the uppermost (or "top") process is a Python3 process called Steam. This is process ID 52015. Under the COMMAND column, you'll note the entire path to the program's executable.

You'll also note that it says it is using 100% of the CPU! And then there are other processes using additional percentages. Sounds mathematically impossible at first until you take into account that the total percentage of CPU that can be used is usually more than 100% (in Linux). That's because most systems today have more than one core in their CPU, and each is treated as a separate entity. This particular system has 6 cores, and each of those uses multi-threading, which multiplies that number by 2. That's 12 simultaneous threads. So you could actually say that this system has a maximum CPU output of 1200%. Similarly, a 10-core system would have 20 threads total and would allow for 2000% CPU usage in total.

We're most certainly breaking all the rules here but in a good way.

If you press the 1 key on the keyboard you will see each of the threads and the percentage used for each. An example of this is shown in Figure 3.

Figure 3 - top showing individual CPU threads

When you press 1 you see the CPU threads listed numerically starting with 0. In the figure, we have Cpu0 through Cpu11 — or 12 threads in total. In this case, each thread has an actual maximum of 100%. Cpu0 is currently at 27.9%. Cpu1 is at 24.2% and so on. If you added the current amounts you would get 201.7%. With a maximum CPU output of 1200%, this system is currently running at about 1/6th of CPU capacity.

To toggle the listed threads back off, simply press the 1 key again. Ultimately, this is the main place where I go to look for load averages.

Some people call these threads "cores". While not technically correct, it's used quite often, so be ready for differing terminology.

Total memory and memory used

You can also analyze the memory used with the top program. Take a look at Figure 4.

Figure 4 - Memory usage

In the fourth row, you can see that the total memory (MiB Mem) is 32023.6 MiB. That's essentially 32 GiB (often referred to simply as 32 GB). Of that total, we are using 5296.9 MiB (or about 5.3 GiB). The available memory for additional processes is 26015.2 MiB.

Note: People often use MB or GB in the place of MiB or Gib. Here's the lowdown on the two:
  • 1 megabyte (MB) = 1,000,000 bytes (or 106). It works off of the base 10 system.
  • 1 mebibyte = 1,048,576 bytes (or 220). It works off the base 2 system.
    When dealing with RAM, the proper term is MiB, and that is what top uses. However, other programs (like free) will use the deprecated mega/giga terminology.
For more information on mebibytes and the differences between MB and MiB see this link.

Now you may say: "Dave, why show this in MiB, I'm more concerned with GiB!" If you indeed said that, well then, I couldn't hear you. Maybe say it louder next time.— wait, that won't work... Anyway, you can change it within top by pressing the capital E. Repeatedly pressing this key allows you to cycle through the different units of measurement. Or, you could start top in a manner that shows GiB by default: top -E g. Finally, if you want it to show GiB by default, and permanently, simply run top, set it to GiB with E, and then save your top configuration by pressing capital W. Now, every time you open top, it will load your top configuration and display memory in GiB. You can also show the individual processes' memory usage as MiB, GiB, and so on, by pressing lowercase e.

You see? I do actually answer these things... after a lot of babbling.

You could also use commands in Linux to check memory. For example, free will show all of the same information about your system's RAM. To show GB instead of MB, use the command free --giga. But again, the beauty of top is that it displays this, and much more information, in one well-designed window.

Troubleshooting with top

As mentioned, I primarily use top to analyze the system and terminate processes that are not behaving. For example, let's say that a web browser freezes up. So we open up top and view the processes. Chances are that the web browser will be listed first, and it will be hovering somewhere around 100% CPU usage. Then, it's just a matter of stopping that process. Easily done!

  1. Press the k key. ("k" for "kill", the less pleasant synonym of "terminate"). By default, it will list the PID that is the highest on the list.
  2. To terminate the listed PID, simply press enter. If you need to terminate another PID, type in that number and then press enter.
  3. Press enter to terminate the process in the default manner. Or, choose the type of signal to send to the PID. By default, it is the #15 signal, called SIGTERM, which is used to signal the standard termination of the process. It attempts to do so in a graceful way but can be blocked or handled by other processes. If 15 doesn't work, the next option is to use signal 9 (SIGKILL), which ends the process immediately, without any interaction. Careful with that, it is an ungraceful termination (a true "kill") and could cause other issues in the system.

At that point, the process should have terminated. If it was a web browser, the window should have closed. In some cases, you might need to reload your desktop by pressing Alt + F2 and typing restart. (Only available with certain desktop modes.)

In the case that you cannot find the process within the top list, you can filter for it by pressing o and then typing COMMAND=<process_name>. So for example, if I wanted to filter for the Firefox browser I would press o and then type COMMAND=firefox-esr. (You could even abbreviate it, for example fire.) That should now show only the Firefox process. This way it is easier to focus on and analyze a single process. When you're done, press = to clear all filters.

Learn more about termination signals at this link.
To list them use the kill -L command as shown in the following figure below.
Figure 5 - Kill Signal Options

Now, you could use Linux commands to do all this. For example, if the calculator program was malfunctioning: use ps aux | grep calc to locate the PID of the calculator, and then kill <PID_NUMBER> to terminate it (as shown in Figure 5 below). In the figure, you can see that the calculator is called "gnome-calculator" and that it is using process ID 8781. That is the ID we would want to terminate. If completed properly, Linux gives no written results. This is the way.

Figure 6 - Using ps aux and kill in the terminal

However, top gives you a single location to do that same procedure, and run an analysis of the system while you are at it. Personally, I like to see the CPU and RAM usage of the system periodically. It's good to keep an eye on such things. But for some reason, if top doesn't work, the previous process would be the backup method for terminating a misbehaving application.

You might find that top refreshes too quickly, or too slowly. The default refresh time is 3 seconds, but it can be modified by pressing d and then entering in a number for your desired refresh time (in seconds).

Color Configuration

How about some fun stuff? (I know, all Linux is fun! Right?)
I tend to use color, maybe too much color. And top is no exception. To modify the colors of top, do the following:

  • Press Z on the keyboard (that's a capital Z). That displays the Color Mapping window as shown in Figure 7 below.
  • In the Color Mapping window that is displayed, note that you can change the colors for four different elements: Summary Data (S), Messages (M), Column Heads (H), and Task Information (T).
  • Select one of the four options by pressing the appropriate key (with shift).
  • Then, select a color from 0 to 7. (Good ol' 3-bit color!)
  • Repeat for each of the elements as you so desire.
  • Press Enter when finished to commit your changes. That will escape back to the main top screen.
Figure 7 - top color mapping

Don't forget to press W to write your configuration to disk. Sure beats the giant white wall of text, right?

The configuration is written to a file named .toprc which is either located in your home directory or in ~/.config/procps
Obviously, there is a lot more to top than just listing processes. In fact, it's a bit daunting how much top can do and how much it can be configured. While working with top, you can get more information by pressing the h key for help. Also, in the terminal, check out the manual page for top: man top, but be warned — it's massive. For fun, check out the "stupid" tricks.

Alternatives to top

There are plenty of other good analysis programs for Linux: btop, htop, btm (known as "bottom"), monitorix, and the list goes on.

The whole thing is such a phenomenon that even Windows has a derivative, called ntop.
"Stop!" you say? No, there is no stop program, but that's what it is known as when you terminate processes!

The following figure shows an example of btop. You can see that it is slightly more graphical, and includes power, temperature, disk, and network monitoring, in addition to processes. This is the main analysis tool I use besides top.

Figure 8 - Example of btop
You could even build your own top-like analysis program. With a little knowledge of C language and the use of the /proc and /sys directories in Linux, you could build something awesome. But with the plethora of options currently out there, it isn't necessary, unless you want a fun project to help you learn Linux programming!
And for those of you that like GUI-based programs, check out gnome-system-monitor, ksysguard, and stacer.

Want to learn more? Here are some links for you:

Thanks for reading this article—it was a long one! Time to top off my coffee. Enjoy your day!
Great! You’ve successfully signed up.
Welcome back! You've successfully signed in.
You've successfully subscribed to Prowse Tech.
Your link has expired.
Success! Check your email for magic link to sign-in.
Success! Your billing info has been updated.
Your billing was not updated.