top

What it does

top displays a continuously updating, full-screen view of running processes ranked by resource usage, along with a summary of overall CPU, memory, swap, and load-average stats at the top of the screen. It's the classic first tool for answering "what's eating my CPU/RAM right now" on a Linux system, and it lets you interact with the process list — sorting, filtering, and even killing processes — without leaving the terminal.

Beginner examples

• top — launch the interactive view, refreshing every 3 seconds by default
• Press q to quit
• Press P to sort by CPU usage, M to sort by memory usage
• Press u then type a username to filter to that user's processes

top

Advanced examples

• Start already sorted by memory usage: top -o %MEM
• Take one snapshot and pipe it through other tools: top -bn1 | head -15
• Watch only specific PIDs (e.g. your app's worker processes): top -p 1234,1235,1236
• Show individual threads of multi-threaded processes: top -H -p 1234
• Log resource usage over time to a file for later analysis: top -b -d 5 -n 12 > usage.log

top -bn1 -o %CPU | head -15

Common mistakes

• Reading %CPU as a percentage of total system capacity rather than per-core; on an 8-core box, 800% means the box is fully saturated, not "way over 100%."
• Confusing RES (resident memory actually in RAM) with VIRT (total virtual memory address space, which can be huge and mostly unused) when judging real memory pressure.
• Forgetting that top's default view only shows a screenful of processes — leaving out quieter processes that may still matter for a specific investigation; use -p to pin ones you care about.
• Trying to script around interactive top output directly instead of using -b (batch mode), which produces unstable, screen-redraw-laden text that's hard to parse.

Tips

• Press 1 to toggle between an aggregate CPU summary line and a per-core breakdown — essential for spotting a single-threaded process pegging one core on a multi-core box.
• Press k to kill a process by PID directly from the UI, and r to renice (change priority) without switching to another terminal.
• Press c to toggle showing the full command line (with arguments) instead of just the process name — useful for distinguishing multiple instances of the same binary.
• Press W to save your current display settings (sort order, columns, delay) to ~/.toprc so they persist next time you launch top.

Best practices

• Use top -bn1 (batch, one iteration) in scripts and cron jobs rather than the interactive mode, which assumes a terminal and will hang or misbehave otherwise.
• When comparing CPU usage across processes, sort with P (or -o %CPU) instead of eyeballing an unsorted list.
• For long-running monitoring or historical graphs, prefer a proper time-series tool (sar, vmstat, or a metrics agent) — top is best for real-time, ad hoc triage.
• Check load average alongside %CPU; a high load average with low per-process CPU% often points to processes blocked on I/O rather than compute-bound work.

Real-world use cases

• Quickly diagnosing a server that feels slow by checking which process is consuming CPU or memory right now, during an incident.
• Killing a runaway process directly from top (k then PID) without needing a second terminal to run ps and kill.
• Watching memory usage climb during a suspected memory leak by sorting with M and observing RES grow for a specific process over several refreshes.

Common interview questions

• What's the difference between RES and VIRT in top's output? VIRT is the total virtual address space a process has mapped (including shared libraries, memory-mapped files, and unused reserved space); RES is the actual physical RAM currently in use — RES is the more meaningful number for real memory pressure.
• How would you find and kill the process using the most memory, without leaving top? Sort with M (or start with top -o %MEM), note the PID at the top, press k, enter the PID, and confirm the signal.
• How do you use top in a non-interactive script? top -bn1 runs top in batch mode for a single iteration and prints plain text output that can be piped, grepped, or logged.