Tracking processes: top - Process Utilization

top provides a repeatedly updated view of system activity and running processes. It is useful for forming a performance hypothesis, but a busy sample alone does not prove the cause of a problem. Compare several updates and correlate them with logs and workload-specific metrics.

Reading the System Summary

A typical display begins with summary lines followed by a process table:

top - 18:06:26 up 6 days, 4:07, 2 users, load average: 0.92, 0.62, 0.59
Tasks: 389 total, 1 running, 387 sleeping, 0 stopped, 1 zombie
%Cpu(s): 1.8 us, 0.4 sy, 0.0 ni, 97.6 id, 0.1 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 32099.0 total, 5276.3 free, 7031.2 used, 19791.5 buff/cache
MiB Swap: 32700.0 total, 32661.0 free, 39.0 used

The first line contains the current time, uptime, logged-in user count, and 1-, 5-, and 15-minute load averages. The task line counts process states. Load average is not a direct CPU percentage; on Linux it reflects runnable tasks and tasks in uninterruptible sleep, so interpret it alongside CPU count, I/O activity, and latency.

CheckWhat do the three load-average values in top represent?

Interpreting CPU Time

Common CPU fields include:

us: user-space execution time.
sy: kernel execution time.
ni: user-space time for niced tasks.
id: idle time.
wa: idle time while an outstanding I/O request exists.
hi and si: hardware- and software-interrupt handling.
st: virtual CPU time taken by the hypervisor for other guests.

A high wa value can support an I/O-wait hypothesis, but it does not identify a device or prove that storage is the only bottleneck. Inspect device latency and application behavior before concluding.

CheckWhat does the wa CPU field report?

Reading the Process Table

Important columns commonly include:

PID, USER, and COMMAND: identity and ownership.
S: state such as running (R), sleeping (S), uninterruptible sleep (D), stopped (T), or zombie (Z).
%CPU and %MEM: sampled CPU activity and share of physical memory.
TIME+: accumulated CPU time.
VIRT: total virtual address space associated with the task.
RES: resident, non-swapped physical memory currently attributed to it.
SHR: resident memory that may be shared with other processes.

VIRT is not the amount of physical RAM consumed. It can include mapped files, shared libraries, reserved address space, and swapped pages. Even RES should be interpreted carefully because shared pages complicate attribution.

CheckWhich field is closer to a process's currently resident physical memory?

Focusing and Sorting

Monitor known PIDs directly:

$ top -p 1234,5678

Inside top, press P to sort by CPU, M to sort by memory, 1 to toggle per-CPU lines, and q to quit on common procps-ng implementations. Press h for the local interactive help because keys and fields can differ by implementation.

Record the PID, command, timestamp, and several samples before taking action. A process briefly reaching the top can be normal, and terminating it can cause data loss or an outage.

CheckWhich invocation limits the display to PID 1234?

Summary

You can now use top to build and test a system-performance hypothesis.

Read load averages as time-windowed load, not CPU percentages.
Compare CPU categories across multiple samples.
Distinguish virtual address space from resident memory.
Focus on known PIDs and verify evidence before acting.

Practice

In the practice terminal, run: top -b -n 1 It should print one snapshot - load averages, CPU states, and the process table - then exit.

top -b -n 1 prints one snapshot and exits.