VMware ESXi and vSphere Cluster Management

Using the top Command to Monitor Linux Processes

Learn how to use Linux top to monitor processes, read CPU and memory statistics, sort tasks, investigate load, and safely stop a process.

top is an interactive terminal program that repeatedly displays system status and running processes. It helps you see which programs are using CPU time or memory, who owns them, and whether the system is under load.

A process is a running instance of a program. Unlike ps, which normally produces a one-time process listing, top refreshes its display continuously. This makes it useful when investigating changing CPU usage, memory pressure, or a process that may be stuck.

Start and Exit top

Open a terminal and run:

top

top takes over the terminal and updates the screen in place. It does not start a graphical application. Press q to quit and return to the shell.

For a single non-interactive snapshot, you can optionally use:

top -b -n 1

The -b option uses batch mode, and -n 1 requests one refresh. Interactive use is the focus of this lesson.

What top Shows

The display normally has two main parts:

• Summary area: system-wide information at the top of the screen.
• Process list: individual tasks below the summary.

The summary commonly includes system uptime, load averages, task counts, CPU activity, physical memory, and swap. Exact labels, fields, colors, and keyboard behavior can differ among Linux distributions and top implementations.

Uptime and Load Averages

Load average is a rolling indicator of runnable tasks and, on Linux, tasks in uninterruptible states such as certain storage waits. top commonly shows averages for the last 1, 5, and 15 minutes. A high load average means that tasks are competing for CPU time or are waiting on another system resource; it does not by itself prove that one process is using all the CPU.

Compare load averages with the number of CPU cores and with the CPU and task information in the rest of the display. A load of 4 may be heavy on a two-core system but less concerning on a 16-core system.

Tasks, CPU, Memory, and Swap

The task summary may show how many processes are running, sleeping, stopped, or in another state. CPU statistics often divide time among user work, kernel work, idle time, and waiting for I/O.

Memory statistics show physical RAM, free or available memory, and sometimes buffers and cache. Swap is disk-backed memory used when memory pages are moved out of RAM. Active swap use can be significant when RAM is scarce, although the presence of some swap use alone does not prove a problem.

Understanding Process Columns

Each row in the process list represents a running process or task. Common columns include the following:

Column names and their exact meanings can vary slightly. In particular, memory accounting depends on the top implementation and system configuration. When investigating memory pressure, compare RES and %MEM with the system-level memory and swap figures instead of relying on VIRT alone.

Interpret CPU and Memory Activity

CPU Usage

A high %CPU value can be normal for expected compute-heavy work such as compilation, video encoding, or scientific calculations. It can also indicate a runaway loop or a malfunctioning task.

On multi-core systems, a multithreaded process may show more than 100 percent CPU, depending on the top configuration. In such displays, 100 percent can represent approximately one fully utilized logical CPU, while several active threads can exceed that value.

Do not decide that a process is broken based on one refresh. Watch several updates, identify the PID and command, and determine whether the workload is expected.

Memory Usage

High memory use must be interpreted alongside available RAM, swap activity, and the expected workload. A large process may be normal on a server designed to cache data or run a database. A process consuming increasing amounts of resident memory while available memory falls may deserve further investigation.

If the system feels slow but no single process dominates CPU, check load averages, task states, memory availability, and swap use. Storage I/O waits or blocked tasks may require additional tools beyond top.

Sort the Process List

top commonly starts with a CPU-oriented ordering, placing recently active CPU consumers near the top. Sorting makes it easier to locate the largest resource users.

Press M to find the largest memory consumers. Compare the leading rows using both %MEM and RES, and watch several refreshes to see whether the values remain elevated. Press P to return to CPU sorting. Use R when the current order needs to be reversed.

Use Help and Navigate

Press h or ? while top is running to open its in-program help. The help screen is authoritative for the installed version because key bindings can vary slightly among distributions and versions.

Basic navigation commonly includes the arrow keys, Page Up, Page Down, and similar keys for moving through the process list. If a key does not behave as expected, consult the built-in help. Some implementations also provide interactive controls for changing fields, filters, or display modes.

Stop a Process from top

top can send a signal to a process through its interactive kill action. A signal is a notification sent to a process. Signals can request a clean shutdown or force a process to stop.

1. Identify the suspicious process in the list.
2. Verify its PID, USER, and COMMAND.
3. Confirm that the process is unwanted or safe to stop.
4. Press k.
5. Enter the target PID when prompted.
6. Enter the signal number or name requested by your version of top.
7. Start with SIGTERM or signal number 15.
8. Observe whether the process exits. Consider SIGKILL only if a justified termination request does not work.

After sending SIGTERM, wait and watch the process list. If the PID remains, verify that it has not changed and that the process is still present. A process owned by another user normally requires appropriate privileges. A task in an uninterruptible kernel wait state may not respond to signals until its wait completes.

Permissions and sudo

A normal user can generally inspect many processes, but visibility and signaling rights depend on system settings, process ownership, and security controls. You may be able to see a row but still be unable to signal that process.

Run top with administrative privileges only when broader process access is necessary:

sudo top

Using sudo can expose more process information and allow actions that affect other users' processes. Avoid elevated access when ordinary top provides the information you need.

Practical Investigation Workflows

Inspect Current System Activity

1. Start top with top.
2. Read the summary area for uptime, load averages, task states, CPU activity, RAM, and swap.
3. Review the leading process rows to see which tasks are currently busiest.
4. Watch multiple refreshes before concluding that a process is malfunctioning.

Find the Largest Memory Consumer

1. Open top.
2. Press M to sort by memory usage.
3. Compare the highest entries using %MEM and RES.
4. Check available memory and swap in the summary.
5. Observe whether the process remains high across several refreshes.

Investigate a Process Using Nearly All CPU

1. Press P to sort by CPU usage.
2. Locate the high-%CPU row.
3. Record its PID, owner, and command.
4. Determine whether the workload is expected.
5. If it is unwanted and safe to stop, press k, enter the PID, and request SIGTERM.
6. Confirm whether it exits before considering SIGKILL.

Get Assistance Inside top

1. Press h or ?.
2. Review the key bindings supported by the installed implementation.
3. Exit the help display according to its instructions.
4. Press q when finished with top.

Troubleshooting Common Problems

A Task Consistently Uses Very High CPU

• Sort by CPU with P.
• Identify the PID, command, and owner.
• Determine whether the workload is expected.
• Observe more than one refresh interval.
• If it is unwanted and safe to stop, request graceful termination before escalating.

The System Feels Slow but No Process Dominates CPU

• Review load averages and task states in the summary.
• Check whether available memory is low or swap is active.
• Sort by memory with M and locate large resident-memory users.
• Remember that storage I/O waits and blocked tasks may require tools beyond top.

A Process Cannot Be Stopped

• Verify that the PID has not changed and that the process still exists.
• Check whether it belongs to another user and whether your privileges are sufficient.
• Try SIGTERM first if it was not already used.
• Use SIGKILL only when the consequences are understood.
• If the process is in an uninterruptible kernel wait state, a signal may not take effect until that wait completes.

Memory Values Look Confusing

• Distinguish VIRT from RES; virtual address space is not the same as RAM in use.
• Use RES and %MEM for an initial view of physical-memory impact.
• Check system-level memory and swap figures before concluding that a process has a memory leak.

Key Points to Remember

• top is a continuously refreshed process monitor, while ps generally provides a one-time listing.
• Use P for CPU sorting and M for memory sorting.
• PID identifies a process; USER identifies its owner.
• RES is a more direct starting point for physical RAM use than VIRT.
• Interpret CPU and memory values with system-wide load, available memory, swap, and workload expectations.
• Press h or ? for version-specific help and q to quit.
• Before using k, verify the PID, owner, command, and purpose. Prefer SIGTERM before SIGKILL.

For a broader process-monitoring lesson, see the top command guide.