Like all great Unix commands, top has a meaning behind its name. It stands for Table Of Processes. Not surprising as it shows a wealth of information running about the system. If you’re running a Linux machine, or macOS (or some BSD variant), top is an extremely useful program. It is a task manager, err..well, more of a system monitor, but has some task manager like properties. The original program was first released in 1984 by William LeFebvre for Unix.

Like a lot of the commands written way back when. There are a few different versions. The original Unix version is different than the version that was released with Linux and the version provided for some macOS/BSD base distributions are different that both of those. I’ll be focusing on the Linux version. I believe a lot of the examples below are transferable between the two, but I haven’t checked, so don’t yell at me if something isn’t exactly the same on your Mac.

display Linux processes – man(1) top

One could probably write a very long and detailed explanation of the top command but today I want to focus on a few of its more common use cases. Basically what I mean by that is, I’ll cover what I use it for plus a few extra things I learned along way. When run, top will take up the whole screen and fill it with the system’s currently running processes, memory and CPU usage in real time!


default view for top
default view for top
When you’re happy with the default view, press q to quit. Yes, this is an interactive tool. Woohoo!

Understanding the top Interface

At the top (see what I did there), you’ll see some basic system information. The way to read the load average is 1.0 is using 100% CPU. Don’t panic if its over 1.0! It’s an average load over all cores. So if you have a quad-core system (8 threads), 1.31 is relatively small. If, however, you have a single-core, single thread, processor (what year is this?) then you might be in trouble.

20:44:34 5 days 12:16 2 users 1.31 1.05 0.82

The next line shows the total number of running processes and a breakdown of them by state. Next, is the CPU usage. us is for user, sy is for system, and id is idle. These are averaged amongst all cores. The last two lines are about memory. The first one states physical memory on the box, and the last line shows virtual memory (swap space).

There’s a blank line between the summary data and the column headers. This is reserved for messages and user interactions (more on that later).

Let’s examine the column headers.

process identifier user running the command process’ priority nice value virtual memory size resident memory size
shared memory size process status CPU usage memory usage time the task has used since it started command name or command line


Since the top command has an interactive interface and isn’t a stream reader/writer like the previous commands covered in Command of the Day. The examples are broken down into different sections.

Command Line Arguments

When the program starts, the processes are sorted by CPU usage. Use the -o flag to sort the data by memory usage (or another column) instead of CPU.

top -o %MEM

To show the command instead of the program name that is being run, you can use the -c flag. For example instead of displaying systemd, it will display /sbin/init under the COMMAND column.

top -c

Summary Data

The following examples show the keys to be pressed after starting the top command. You can change the way the information is displayed by pressing the following buttons while inside top.

m Toggles how memory data is displayed
1 Single/Separate CPU Cores
t Toggles CPU view (similar to m)
l Toggles the view for the top row

I personally prefer to see the load under each CPU core, and I like to see the memory in a graph form. I have a tendency to hit 1 and m as soon as top starts.

Task Information

This is the area under the column heads.


By default top sorts by %CPU. To remember what field is being sorted you can press the x key and it will bold the column that it is being ordered by. If CPU usage isn’t your style, you can use the following keys to change the sorting.

M Memory %MEM
P CPU Usage %CPU
N Process ID PID
T time started TIME+

Killing Tasks

This is one of my most used features of top. Let’s simulate a long running process that needs to be killed (and let’s assume that it’s using a lot of CPU).

sleep 30 &disown
[1] 21980
top -o PID

top ordered by PID
find the sleep command within your list

Now we can hit the k key and a message will pop up asking you which process to kill (remember that blank space I mentioned earlier?). Enter in the PID for sleep and hit Enter. After that it will ask you for the [signal](https://en.wikipedia.org/wiki/Signal_(IPC%29) you want to send to it. Sending 3 will send a SIGQUIT signal, which is safe and likely to end the process. If, after 3 seconds, you find that the processes is still running and you see it in your list (cheeky bastard), you can run the kill process again but this time pass in the number 9. This will send a SIGKILL to the process. This cannot be blocked by the process.

Formatting and Scrolling

top with formatting
top with a few formatting options
Using the j and J keys you can manipulate which side some of the columns will align to. Typing V will show the commands is Forrest View. This shows the parent processes and their children in a tree like fashion. A similar affect can be seen with ps -aef --forest. Obviously the list of processes on your screen are not the only ones. If you hit the page up and page down keys you can scroll through. The home and end keys work as well. For some quick searching, you can use the L key, and then for the next occurrence type &.

Changing Colors

This is by far the most fun part of the program. Start up the top program and then hit z. You should see the colors change from white to red. Cool, right? But red is not really my color, more of a purple guy. Hitting the Z key brings up the interactive color selector.

top colors changed up
colors all topsy-turvy


Safe to say, that the top command is a must know for any system administrator. It’s a powerful tool that can allow one to quickly get an overview of what’s happening on the system. It can show zombie’d processes, and which ones are using up all the CPU and memory in real time. While top has a full feature set, I tend to use it in a limited capacity. It is a great quick way to asses the current system under load.

This is only a general overview of top and there is a lot more functionality to be discovered. I recommend perusing the man page first, but do check out some of the references below as they will give you a more thorough (and quite long) description of the features of top. Also, if you’re new to the Unix world, or just want a better understanding, I recommend reading some of the links throughout this post. It can help you better understand the foundation of your OS, but also a better idea of what top is displaying.


It’s no lie that top has been the top CLI system monitor for a long time running. But that doesn’t mean there are other players in the game. Below are a few more applications that are CLI system monitors, with varying feature sets.

  • htop is one of the more known top alternatives. It’s written in C as well and is installed by default on my Ubuntu 18.04 server, and a good chance its installed on your Linux system by default as well.
  • gtop is a NodeJS based, cross-platform application. While I’m not a fan of NodeJS, it does have a very sexy UI and that just might be worth it.
  • Glances a very feature rich system monitor written in python. Not only can you view the information on your command line, but it also offers a WebUI and the option for remote monitoring.