VMware ESXi and vSphere Cluster Management

Monitor Running Processes in Real Time with top on Raspberry Pi

Learn how to use top on Raspberry Pi OS to monitor CPU and memory usage, sort processes, understand key columns, and safely stop an unresponsive process.

A process is a running instance of a program managed by the operating system. For example, a terminal window, a web server, or a media player may each run as one or more processes.

top is an interactive Linux utility that repeatedly displays system activity and running processes in a terminal. Unlike a one-time process listing, it refreshes the display automatically so you can observe a changing workload.

Real-time process monitoring is useful when a Raspberry Pi is slow, an application is unresponsive, the CPU fan or temperature rises, memory is low, or an unexpected program is running. You can identify which process is using resources before deciding what action to take.

Start and quit top

Open a terminal on Raspberry Pi OS and run:

top

The terminal changes to an interactive display. It refreshes at short intervals, so values such as CPU and memory usage change as processes do work.

To leave the display and return to the shell, press:

While top is active, type keyboard commands directly. You normally do not need to press Enter after commands such as P, M, or q.

Understand the top screen

The display has two important parts:

System summary area: Information about the system and its current workload, including uptime, users, tasks, CPU activity, and memory information.
Per-process table: A list in which each row represents a running process.

The process table shows a snapshot taken during the current refresh. A process can move up or down between refreshes as its CPU or memory use changes. A high value in one refresh may be a short burst rather than a persistent problem.

Process-level values describe how individual programs contribute to the current system workload. The summary area describes the system as a whole. Comparing both helps distinguish one busy program from a broader CPU or memory constraint.

Essential process columns

Column names can vary slightly between versions of top, but these fields are commonly visible:

Field	Meaning	How to use it when diagnosing a process
PID	The numeric process identifier.	Use it to target one specific process. Multiple instances of the same command can have different PIDs.
USER	The account that owns or started the process.	Confirm which user launched it and whether you have permission to manage it.
PR	The scheduler priority.	Shows a scheduler-related value that affects how the system allocates processor attention.
NI	The nice value, a scheduling preference related to priority.	Helps explain why a process may receive more or less scheduling preference. It is not a direct CPU-usage measurement.
VIRT	The virtual address space associated with the process.	Do not treat this number as the amount of physical RAM currently consumed.
RES	Resident memory currently held in physical RAM rather than swapped out.	Use it with `%MEM` when investigating physical memory consumption.
%CPU	The current CPU share attributed to the process.	Use it to find processor-intensive work, while checking several refreshes for persistence.
%MEM	The percentage of physical memory attributed to the process.	Use it to find processes contributing substantially to RAM pressure.
COMMAND	The executable command or program name associated with the process.	Use it with PID and USER to identify the actual application before taking action.

VIRT and RES are different: VIRT describes a process's virtual memory address space. RES describes the part currently resident in physical RAM. When diagnosing limited Raspberry Pi memory, RES and %MEM are usually more directly useful than VIRT.

Sort processes interactively

top initially presents processes ordered by CPU activity in many standard configurations. Sorting changes which entries appear at the top; it does not change the processes themselves.

Key	Action	Typical use
`P`	Order by CPU usage.	Find programs currently consuming processor time.
`M`	Order by memory usage.	Find programs contributing most to physical memory use.
`R`	Reverse the current ordering direction.	Change between highest-first and lowest-first ordering for the active field.
`<`	Move through available sort fields in one direction.	Choose another field when the standard CPU or memory ordering is not enough.
`>`	Move through available sort fields in the other direction.	Cycle through alternative fields while inspecting the table.
`k`	Begin the interactive process-termination action.	Request termination after verifying the correct PID and process identity.
`q`	Exit `top`.	Return to the shell.

When to use CPU sorting

Press P when the suspected bottleneck is processor time. Compare the leading process's %CPU with its PID, USER, and COMMAND. Then watch several refreshes to determine whether the load is sustained.

When to use memory sorting

Press M when the Pi appears to be running out of memory or is slowing because of memory pressure. Compare RES and %MEM for the leading entries, then use COMMAND and PID to identify the application.

Practical monitoring examples

Find a CPU-intensive program

Launch top from a terminal.
Press P to order processes by CPU activity.
Read the leading row's %CPU, then compare its PID, USER, and COMMAND.
Observe multiple refresh cycles. A process appearing at the top briefly may simply be performing a short task.

top

Find a memory-heavy program

Launch top.
Press M to sort by memory usage.
Compare RES and %MEM for the leading processes.
Use COMMAND, PID, and USER together to identify the application.

Inspect a changing Raspberry Pi workload

Start a resource-intensive task or application and watch its CPU and memory readings across several refreshes. Press P to see its CPU ranking, then press M to see its memory ranking. A process can rank highly in one list but not the other because processor use and memory use measure different resources.

Stop a process from top

Stopping a process sends it an operating-system signal. A signal is a notification requesting that a process take an action, including termination.

Use this action carefully:

Identify the process using PID, USER, and COMMAND. Do not rely on the command name alone, because several instances may exist.
Try closing the application normally first. Normal shutdown allows the program to save data and release resources cleanly.
With top active, press k.
When top asks for a PID, enter the verified numeric PID and confirm the action.
Allow the process time to exit, then watch the table to confirm that it has disappeared or that its resource use has changed.

The usual termination request is a normal termination signal. If a process will not respond, a forced signal may be necessary, but it should be a last resort because it does not give the application the same opportunity to shut down cleanly.

A safe monitoring workflow

Observe: Start top and check whether the high CPU or memory value persists over multiple refreshes.
Sort: Use P for a CPU problem or M for a memory problem.
Identify: Confirm PID, USER, and COMMAND together.
Verify: Decide whether the process is an expected application, a service, or an unfamiliar system process.
Act cautiously: Close an application normally before using k in top.
Recheck: Continue watching the process list after the action to confirm the resulting system state.

Troubleshoot common situations

A process appears at the top only briefly

Short bursts of activity may be normal. Continue watching several refreshes before treating the entry as a persistent performance issue.

The wrong process might be terminated

A command name can be ambiguous, and multiple instances may exist. Verify PID, USER, and COMMAND together. Prefer closing the application normally before sending a termination signal.

The current user cannot stop a process

The process may belong to another account or require elevated administrative permission. Confirm ownership and purpose first; do not terminate an unfamiliar system process merely because it uses resources.

High memory figures are confusing

VIRT and RES measure different things. Use RES and %MEM when discussing physical RAM consumption, and interpret VIRT as virtual address-space usage.

The Pi remains slow after one process is stopped

More than one workload or a broader resource constraint may be involved. Continue monitoring, inspect both CPU and memory sort orders, and look for other entries that remain high across multiple refreshes.

top compared with ps

ps is a process-listing command that normally provides a non-refreshing snapshot. It is useful when you want a result to inspect or redirect, while top is better for watching activity change in real time. Both can show process identifiers and command information, but top provides an interactive, continuously refreshed view.

Exam-relevant points

A process is a running program instance managed by the operating system.
top repeatedly refreshes a terminal display; ps normally gives a one-time snapshot.
PID identifies a process, USER identifies its owning account, and COMMAND identifies the associated program.
Use P for CPU sorting and M for memory sorting.
Use R to reverse the active sort direction and < or > to cycle through sort fields.
Use k to begin termination through top, but verify the PID and process identity first.
RES represents physical RAM currently resident for the process; VIRT represents virtual address space.
Press q to quit top.