Monitor Running Processes in Real Time with top on Raspberry Pi

Learn how to use top on Raspberry Pi OS to monitor CPU and memory use, sort processes, read process details, and safely stop an unresponsive process.

When a Raspberry Pi becomes slow, the first useful question is often: which program is using the system resources? Raspberry Pi OS includes top, an interactive terminal monitor that continually displays running processes and system activity.

A process is an instance of a program that is currently executing. Applications, desktop components, background services, and commands started from a terminal all run as processes.

This guide assumes that you can open a terminal and enter basic Linux commands. If you need a refresher, see using the terminal on Raspberry Pi OS.

Why monitor processes in real time?

Real-time process monitoring helps you investigate slow performance instead of guessing. You can use it to:

Find a program that is consuming an unusually large amount of CPU.
Identify applications using substantial physical memory.
Watch whether a resource spike is temporary or continues across several refreshes.
Record a process name and PID before taking further action.
Locate a process when you need to close or terminate it.

The ps command provides a point-in-time listing. By contrast, top repeatedly refreshes its display while it runs, so the values and process rows can change from one refresh to the next. Use ps to list processes when a snapshot is sufficient, and use top when you need to observe activity over time.

Start and exit top

Open a terminal and run:

top

The terminal switches to an interactive display. The summary area is updated automatically at regular intervals, followed by a table of running processes. You do not normally need to rerun the command to obtain fresh information.

To leave the interactive display safely, press:

The q key is pressed while top has focus. It exits the monitor; it does not stop the processes shown in the list.

Important: The keyboard commands in this article apply while top is running. They are not commands that you type at the normal shell prompt.

Understand the top display

The display has two main sections:

System summary: Shows information such as system uptime, logged-in users, load averages, total tasks, CPU activity, and memory or swap usage.
Process table: Shows one row for each process visible to your account, with columns describing ownership, scheduling, memory, CPU use, and the associated command.

The exact summary wording can vary between Raspberry Pi OS versions and terminal sizes. Focus on the process columns when looking for an individual resource-heavy program.

Important top process columns

Column	Meaning	How to use it when troubleshooting
PID	Process identifier: the number that distinguishes this running process.	Record it before sending a signal or investigating the process further.
USER	The account that owns or started the process.	Helps distinguish your application from another user's process or a system service.
PR	Scheduler priority associated with the process.	Provides context about how the scheduler treats the process; do not change it casually.
NI	Nice value, which influences a process's scheduling preference.	Useful when comparing processes with different scheduling preferences.
VIRT	Virtual address space attributed to the process.	Do not treat it as the amount of physical RAM currently consumed.
RES	Resident memory currently held in physical RAM rather than swapped out.	Use it with `%MEM` to find applications occupying physical memory.
%CPU	The CPU time share currently attributed to the process.	Look for consistently high values when investigating processor load.
%MEM	The share of physical memory used by the process.	Look for processes using a disproportionate share of available RAM.
COMMAND	The executable or command associated with the process.	Use it with PID and USER to verify what you are investigating.

Virtual memory versus resident memory

VIRT represents the process's virtual address space. This can include mapped files, shared libraries, reserved address ranges, and memory that is not currently occupying physical RAM. A large VIRT value does not automatically mean that the process is using that much RAM.

RES is the portion currently resident in physical memory. For a practical view of RAM pressure, compare RES and %MEM, along with the memory summary at the top of the display.

CPU and memory percentages are most useful when considered over several refreshes. A process that briefly rises to the top during boot, an update, compilation, or browser activity may be behaving normally.

Sort and navigate the process list

top normally presents processes in a CPU-oriented order, with high CPU users near the top. The first rows are not automatically the most important processes in every investigation, however. Always check the active sort column and direction before drawing conclusions.

Useful sorting shortcuts

Key	Action	Typical use
`P`	Sort process rows by CPU activity.	Find programs currently using the processor.
`M`	Sort process rows by memory use.	Find programs using substantial physical memory.
`R`	Reverse the current sorting direction.	Change whether larger or smaller values appear first.
`<`	Move the selected sort field toward the previous available column.	Choose a different field for sorting.
`>`	Move the selected sort field toward the next available column.	Choose a different field for sorting.
`k`	Begin the interactive process termination workflow.	Send a signal to a selected PID after verifying its identity.
`q`	Exit `top`.	Return to the shell without stopping listed processes.

The capital letters are normally entered with Shift, such as Shift+P for P and Shift+M for M. After changing the sort, inspect the column heading and direction indicator shown by your version of top.

Example: find a process causing a slow desktop

Open the monitor with top.
Observe the upper rows in the default CPU-oriented view.
Press P to explicitly select CPU sorting.
Compare the process's COMMAND, PID, USER, and %CPU.
Watch the process across several refreshes before deciding whether its activity is expected.

A compiler, browser tab, update task, or startup service may use substantial CPU temporarily. A process that remains near the top and keeps the Raspberry Pi slow deserves further investigation.

Example: find a program using too much RAM

Start top.
Press M to order the list by memory use.
Inspect RES and %MEM alongside COMMAND.
Record the PID and USER if the usage remains high.
Close the application through its normal interface when possible.

Sorting by memory can reveal a problem even when no process dominates CPU usage. If the Raspberry Pi is slow but the CPU list does not show an obvious cause, check the memory summary and inspect the largest RES and %MEM values.

Watch for persistent resource use

A single high reading is not enough to establish a fault. Observe the process over several display refreshes and compare the changing CPU and memory figures.

Transient load: A value rises briefly and then falls as the task completes.
Persistent load: CPU or memory use remains high across multiple refreshes and affects responsiveness.

Before taking action, gather the command name, PID, and owning user. This information makes it less likely that you will act on the wrong process.

Stop a process from top

Stopping a process means sending it a signal, which is a message requesting an action. The interactive workflow in top is:

Identify the exact process row.
Verify its PID, USER, and COMMAND.
Press k.
Enter the target PID when prompted, then submit it.
Enter a signal number or name when prompted, then submit it. If top offers a default signal, accept it for a normal termination attempt unless you have a specific reason not to.
Wait for the process to exit and confirm that its row disappears or its resource use falls.

Try normal termination first

Signal	Purpose	When to use	Caution
SIGTERM	A normal request for the process to terminate, allowing it an opportunity to clean up.	Use first for an unresponsive user application or known process that should be stopped.	The process may take time to finish or may not respond.
SIGKILL	A forced termination signal that cannot be handled or ignored by the target process.	Use only as a last resort when a confirmed process does not respond to normal termination.	It prevents cleanup and can cause data loss or leave temporary state behind.

Do not terminate a process merely because it appears near the top of the list. Verify the PID, account, command, and likely consequences first. Stopping an application can discard unsaved work. Stopping a service can interrupt networking, audio, the desktop, storage access, or another Raspberry Pi function.

Processes owned by another account or by the system may require elevated permissions. Check USER and COMMAND, understand the process's role, and use administrative procedures only when you are certain what the process does. Avoid forcing unknown system processes to stop.

Safe monitoring and troubleshooting practices

Expect short CPU spikes during boot, software updates, compilation, and browser use.
Treat consistently high CPU or memory use as more meaningful than a brief refresh-to-refresh change.
Record the PID, USER, and COMMAND before taking action.
Close an application normally before sending it a signal when the application interface still works.
Restart a specific, known service through an appropriate service-management procedure rather than killing an unknown service process.
Use SIGKILL only after confirming the PID again and understanding the consequences.

Common problems

A process appears at the top only briefly: Observe several refresh cycles and verify the active sort field. The reading may represent a normal temporary workload.

The CPU list does not explain the slowdown: Press M and inspect RES and %MEM. Memory pressure may be contributing even when CPU use is distributed across processes.

You cannot terminate a process: Check its USER and COMMAND. It may belong to another account or be protected as a system service. Do not kill an unknown process simply to remove it from the display.

A process remains after SIGTERM: Reconfirm the PID and application identity, then allow a short time for shutdown. If the process is definitely the intended target and remains hung, consider a forced signal only as a last resort.

The wrong application was closed: PID-based termination affects whichever process matches the selected PID. Always verify PID, USER, and COMMAND immediately before pressing k, and prefer the application's normal close operation.

Quick reference

top       # Start the real-time process monitor
P         # Sort by CPU activity
M         # Sort by memory use
R         # Reverse the current sort direction
< or >   # Move through available sort fields
k         # Select a PID and send a signal
q         # Exit top

For related command-line practice, see useful Raspberry Pi terminal commands. When you need a non-interactive process snapshot, see listing running processes.

Exam-relevant note: top continually refreshes an interactive process view, while ps normally reports a point-in-time listing. Remember that PID identifies a process, RES represents resident physical memory, VIRT is virtual address space, P sorts by CPU, M sorts by memory, and a normal termination request should be attempted before a forced kill.