kmail.at
contact
kmail.at
contact

elsewhere

EnglishEN
← learning

sysadmin · difficulty ◆

top — watch your machine choke in real time

A live dashboard of every process on your box — and the first thing you open when something's spinning out of control.

The moment something pegs your CPU to 100%, top is the first thing you'll type — and the process eating it is almost never the one you were expecting.

fully AI-generatedThis text is fully AI-generated and was published without human editorial review.

2026-08-31 · 5 min read

$ top

What it does

top prints a live, refreshing view of every running process, sorted by CPU usage, plus a summary header of load, memory, and swap. It is the poor-man's production monitor: no install, no agent, just press q to leave. On this box right now it shows 519 tasks, a load average of 0.27, and my Obsidian instance chewing 183 minutes of CPU time.

Why it matters

When a server goes slow, top is the first diagnostic you run because it answers three questions at once: Is the CPU pegged? Is memory exhausted (and is swap thrashing)? Which specific process is the culprit? Unlike ps, which is a snapshot, top keeps updating so you can watch a process's CPU hover or spike. Master it and 'the machine is slow' becomes 'obsidian is at 99% CPU, kill that PID'.

Example

$ top -bn1 | head -12
top - 09:02:25 up 13 days, 11:13,  1 user,  load average: 0.27, 0.36, 0.43
Tasks: 519 total,   1 running, 518 sleeping,   0 stopped,   0 zombie
%Cpu(s):  1.2 us,  2.4 sy,  0.0 ni, 96.4 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st 
MiB Mem :  15698.5 total,   1345.3 free,   5460.5 used,   9275.1 buff/cache     
MiB Swap:   4096.0 total,    787.1 free,   3308.9 used.  10238.0 avail Mem 

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
3229689 kmail     20   0   13212   6556   4332 R  21.4   0.0   0:00.06 top
2298792 kmail     20   0 1392.2g  48976  16484 S   7.1   0.3 183:04.22 obsidian
      1 root      20   0   23360  14384   9212 S   0.0   0.1   3:32.18 systemd

-b is batch mode (no live refresh), -n1 runs exactly one frame — perfect for scripting or piping. This is exactly what top 4.0.4 printed on my machine.

$ top -o %MEM -bn1 | head -8
top - 09:02:25 up 13 days, 11:13,  1 user,  load average: 0.27, 0.36, 0.43
    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
3229689 kmail     20   0   13212   6556   4332 R  21.4   0.0   0:00.06 top
      1 root      20   0   23360  14384   9212 S   0.0   0.1   3:32.18 systemd
2298792 kmail     20   0 1392.2g  48976  16484 S   7.1   0.3 183:04.22 obsidian

-o sorts by a column other than CPU. When the box is swapping, sort by %MEM to spot the process holding gigabytes of RES (resident) memory.

$ top -p 2298792 -bn1 | tail -1
2298792 kmail     20   0 1392.2g  48976  16484 S   7.1   0.3 183:04.22 obsidian

-p filters to specific PIDs. The VIRT of 1392.2g is the giveaway that obsidian maps a huge address space — but RES (48 MB) is what's actually in RAM. Don't panic at VIRT.

Common flags

-b
batch mode — no live refresh, prints frames and exits, for scripts and logs
-n N
run N frames (combine with -b for a bounded snapshot)
-o COLUMN
sort by a column, e.g. -o %MEM, -o TIME+
-p PID
only show the given PIDs
-u USER
only show one user's processes
-d SECS
set the refresh delay in seconds
-(interactive) k
inside live top, press k then a PID to kill that process — no Ctrl-C needed

History

Origin

top was originally written by Roger Binns for SunOS in the 1980s, a time when 'the machine is slow' meant physically walking to the server room. It was rewritten by William LeFebvre, who maintained it for decades and whose version became the canonical one on most Unixes. The name is just 'top' — it shows the top processes by resource use.

Where it sits today

The Linux top you run comes from procps-ng, the same package family as ps and free. Because it reads /proc — the pseudo-filesystem where the kernel exposes every process as a directory — top needs no special privileges for your own processes. Rival htop shows tree views and colors, but plain top is the one that's guaranteed installed on every distro and every production box.

Fun facts

Pros & cons

pros

  • + Guaranteed installed on every Linux box — zero setup for triage
  • + Live view shows CPU, memory, swap, and load in one screen
  • + Sortable and filterable by column, user, or PID
  • + Batch mode (-bn1) makes it a scripting/logging tool, not just an eye-on-the-screen one

cons

  • − Text-only interface looks dated next to htop's colors and tree
  • − Sorting and column selection are interactive-menu based and easy to forget
  • − It reads /proc snapshots — fine for triage, but no historical trending or alerts
  • − %CPU can look alarming until you remember it goes past 100 on multi-core

Takeaways

  1. 1First triage on a slow box: `top -bn1 | head` gives you the whole picture in one frame
  2. 2Sort by the real killer: `top -o %MEM` when swap is thrashing, keep %CPU when it's hot
  3. 3Judge memory by RES and %MEM, never by VIRT
  4. 4In live top, press k + PID to kill a runaway process without opening another terminal
  5. 5For scripts and logs use -bn1; for watching something spike, just run top and press space to refresh

Related commands

archive entry — written and published by a scheduled job, never editorially reviewed. Kept for reference: out of the site’s search index, and no ads run here. the reviewed library →

← all learning