top (1) - Linux Manuals
top: display Linux processes
NAME
SYNOPSIS
top -hv|-bcEeHiOSs1 -d secs -n max -u|U user -p pids -o field -w [cols]The traditional switches `-' and whitespace are optional.
DESCRIPTION
The top program provides a dynamic real-time view of a running system. It can display system summary information as well as a list of processes or threads currently being managed by the Linux kernel. The types of system summary information shown and the types, order and size of information displayed for processes are all user configurable and that configuration can be made persistent across restarts.The program provides a limited interactive interface for process manipulation as well as a much more extensive interface for personal configuration -- encompassing every aspect of its operation. And while top is referred to throughout this document, you are free to name the program anything you wish. That new name, possibly an alias, will then be reflected on top's display and used when reading and writing a configuration file.
OVERVIEW
Documentation
The remaining Table of Contents
OVERVIEW
Operation
Linux Memory Types
1. COMMAND-LINE Options
2. SUMMARY Display
a. UPTIME and LOAD Averages
b. TASK and CPU States
c. MEMORY Usage
3. FIELDS / Columns Display
a. DESCRIPTIONS of Fields
b. MANAGING Fields
4. INTERACTIVE Commands
a. GLOBAL Commands
b. SUMMARY AREA Commands
c. TASK AREA Commands
1. Appearance
2. Content
3. Size
4. Sorting
d. COLOR Mapping
5. ALTERNATE-DISPLAY Provisions
a. WINDOWS Overview
b. COMMANDS for Windows
c. SCROLLING a Window
d. SEARCHING in a Window
e. FILTERING in a Window
6. FILES
a. PERSONAL Configuration File
b. ADDING INSPECT Entries
c. SYSTEM Configuration File
d. SYSTEM Restrictions File
7. STUPID TRICKS Sampler
a. Kernel Magic
b. Bouncing Windows
c. The Big Bird Window
d. The Ol' Switcheroo
8. BUGS, 9. SEE Also
Operation
When operating top, the two most important keys are the help (h or ?) key and quit (`q') key. Alternatively, you could simply use the traditional interrupt key (^C) when you're done.When started for the first time, you'll be presented with these traditional elements on the main top screen: 1) Summary Area; 2) Fields/Columns Header; 3) Task Area. Each of these will be explored in the sections that follow. There is also an Input/Message line between the Summary Area and Columns Header which needs no further explanation.
The main top screen is generally quite adaptive to changes in terminal dimensions under X-Windows. Other top screens may be less so, especially those with static text. It ultimately depends, however, on your particular window manager and terminal emulator. There may be occasions when their view of terminal size and current contents differs from top's view, which is always based on operating system calls.
Following any re-size operation, if a top screen is corrupted, appears incomplete or disordered, simply typing something innocuous like a punctuation character or cursor motion key will usually restore it. In extreme cases, the following sequence almost certainly will:
key/cmd objective
^Z suspend top
fg resume top
<Left> force a screen redraw (if necessary)
But if the display is still corrupted, there is one more step you could try. Insert this command after top has been suspended but before resuming it.
key/cmd objective
reset restore your terminal settings
Note: the width of top's display will be limited to 512 positions. Displaying all fields requires approximately 250 characters. Remaining screen width is usually allocated to any variable width columns currently visible. The variable width columns, such as COMMAND, are noted in topic 3a. DESCRIPTIONS of Fields. Actual output width may also be influenced by the -w switch, which is discussed in topic 1. COMMAND-LINE Options.
Lastly, some of top's screens or functions require the use of cursor motion keys like the standard arrow keys plus the Home, End, PgUp and PgDn keys. If your terminal or emulator does not provide those keys, the following combinations are accepted as alternatives:
key equivalent-keys
Left alt + h
Down alt + j
Up alt + k
Right alt + l
Home alt + ctrl + h
PgDn alt + ctrl + j
PgUp alt + ctrl + k
End alt + ctrl + l
The Up and Down arrow keys have special significance when prompted for line input terminated with the <Enter> key. Those keys, or their aliases, can be used to retrieve previous input lines which can then be edited and re-input. And there are four additional keys available with line oriented input.
key special-significance
Up recall older strings for re-editing
Down recall newer strings or erase entire line
Insert toggle between insert and overtype modes
Delete character removed at cursor, moving others left
Home jump to beginning of input line
End jump to end of input line
Linux Memory Types
For our purposes there are three types of memory, and one is optional. First is physical memory, a limited resource where code and data must reside when executed or referenced. Next is the optional swap file, where modified (dirty) memory can be saved and later retrieved if too many demands are made on physical memory. Lastly we have virtual memory, a nearly unlimited resource serving the following goals:
1. abstraction, free from physical memory addresses/limits 2. isolation, every process in a separate address space 3. sharing, a single mapping can serve multiple needs 4. flexibility, assign a virtual address to a file
Regardless of which of these forms memory may take, all are managed as pages (typically 4096 bytes) but expressed by default in top as KiB (kibibyte). The memory discussed under topic `2c. MEMORY Usage' deals with physical memory and the swap file for the system as a whole. The memory reviewed in topic `3. FIELDS / Columns Display' embraces all three memory types, but for individual processes.
For each such process, every memory page is restricted to a single quadrant from the table below. Both physical memory and virtual memory can include any of the four, while the swap file only includes #1 through #3. The memory in quadrant #4, when modified, acts as its own dedicated swap file.
Private | Shared
1 | 2
Anonymous . stack |
. malloc() |
. brk()/sbrk() | . POSIX shm*
. mmap(PRIVATE, ANON) | . mmap(SHARED, ANON)
-----------------------+----------------------
. mmap(PRIVATE, fd) | . mmap(SHARED, fd)
File-backed . pgms/shared libs |
3 | 4
The following may help in interpreting process level memory values displayed as scalable columns and discussed under topic `3a. DESCRIPTIONS of Fields'.
%MEM - simply RES divided by total physical memory
CODE - the `pgms' portion of quadrant 3
DATA - the entire quadrant 1 portion of VIRT plus all
explicit mmap file-backed pages of quadrant 3
RES - anything occupying physical memory which, beginning with
Linux-4.5, is the sum of the following three fields:
RSan - quadrant 1 pages, which include any
former quadrant 3 pages if modified
RSfd - quadrant 3 and quadrant 4 pages
RSsh - quadrant 2 pages
RSlk - subset of RES which cannot be swapped out (any quadrant)
SHR - subset of RES (excludes 1, includes all 2 & 4, some 3)
SWAP - potentially any quadrant except 4
USED - simply the sum of RES and SWAP
VIRT - everything in-use and/or reserved (all quadrants)
Note: Even though program images and shared libraries are considered private to a process, they will be accounted for as shared (SHR) by the kernel.
1. COMMAND-LINE Options
The command-line syntax for top consists of:
The typically mandatory switch (`-') and even whitespace are completely
optional.
Fractional seconds are honored, but a negative number is not allowed.
In all cases, however, such changes are prohibited if top is running
in Secure mode, except for root (unless the `s' command-line option was used).
For additional information on Secure mode see topic 6d. SYSTEM Restrictions File.
Later this can be changed with the `e' command toggle.
Later this can be changed with the `E' command toggle.
This option exists primarily to support automated/scripted batch mode
operation.
A pid value of zero will be treated as the process id of the top program
itself once it is running.
This is a command-line option only and should you wish to return to normal operation,
it is not necessary to quit and restart top -- just issue any
of these interactive commands: `=', `u' or `U'.
The `p', `u' and `U' command-line options are mutually exclusive.
Prepending an exclamation point (`!') to the user id or name instructs top
to display only processes with users not matching the one provided.
The `p', `u' and `U' command-line options are mutually exclusive.
In normal display mode, when used without an argument top will attempt
to format output using the COLUMNS= and LINES= environment variables, if set.
With an argument, output width can only be decreased, not increased.
Whether using environment variables or an argument with -w, when not
in Batch mode actual terminal dimensions can never be exceeded.
Note: Without the use of this command-line option, output width is always based on the
terminal at which top was invoked whether or not in Batch mode.
See the `1' and '2' interactive commands for additional information.
Line 1 shows total tasks or threads, depending on the state
of the Threads-mode toggle.
That total is further classified as:
Line 2 shows CPU state percentages based on the interval since the
last refresh.
As a default, percentages for these individual categories are displayed.
Where two labels are shown below, those for more recent kernel versions
are shown first.
In the alternate cpu states display modes, beyond the first tasks/threads line,
an abbreviated summary is shown consisting of these elements:
Where: a) is the `user' (us + ni) percentage; b) is the `system'
(sy + hi + si) percentage; c) is the total; and d) is one of two
visual graphs of those representations.
See topic 4b. SUMMARY AREA Commands and the `t' command for additional information
on that special 4-way toggle.
As a default, Line 1 reflects physical memory, classified as:
Line 2 reflects mostly virtual memory, classified as:
The avail number on line 2 is an estimation of physical memory available for
starting new applications, without swapping.
Unlike the free field, it attempts to account for readily reclaimable
page cache and memory slabs.
It is available on kernels 3.14, emulated on kernels 2.6.27+, otherwise
the same as free.
In the alternate memory display modes, two abbreviated summary lines
are shown consisting of these elements:
Where: a) is the percentage used; b) is the total available; and c) is one of two
visual graphs of those representations.
In the case of physical memory, the percentage represents the total minus the estimated
avail noted above.
The `Mem' graph itself is divided between used and any remaining memory not
otherwise accounted for by avail.
See topic 4b. SUMMARY AREA Commands and the `m' command for additional information
on that special 4-way toggle.
This table may help in interpreting the scaled values displayed:
Any field is selectable as the sort field, and you control whether they
are sorted high-to-low or low-to-high.
For additional information on sort provisions
see topic 4c. TASK AREA Commands, SORTING.
The fields related to physical memory or virtual memory reference `(KiB)' which is the
unsuffixed display mode.
Such fields may, however, be scaled from KiB through PiB.
That scaling is influenced via the `e' interactive command or established for startup
through a build option.
In a true SMP environment, if a process is multi-threaded and top is
not operating in Threads mode, amounts greater than 100% may be
reported.
You toggle Threads mode with the `H' interactive command.
Also for multi-processor environments, if Irix mode is Off, top
will operate in Solaris mode where a task's cpu usage will be
divided by the total number of CPUs.
You toggle Irix/Solaris modes with the `I' interactive command.
Note: When running in forest view mode (`V') with children
collapsed (`v'), this field will also include the CPU time of
those unseen children.
See topic 4c. TASK AREA Commands, CONTENT for more information regarding
the `V' and `v' toggles.
See `OVERVIEW, Linux Memory Types' for additional details.
This will typically be the last entry in the full list of control
groups as shown under the next heading (CGROUPS).
And as is true there, this field is also variable width.
Control Groups provide for allocating resources (cpu, memory, network
bandwidth, etc.) among installation-defined groups of processes.
They enable fine-grained control over allocating, denying, prioritizing,
managing and monitoring those resources.
Many different hierarchies of cgroups can exist simultaneously on a system
and each hierarchy is attached to one or more subsystems.
A subsystem represents a single resource.
Note: The CGROUPS field, unlike most columns, is not fixed-width.
When displayed, it plus any other variable width columns will be allocated
all remaining screen width (up to the maximum 512 characters).
Even so, such variable width fields could still suffer truncation.
See topic 5c. SCROLLING a Window for additional information on accessing
any truncated data.
See `OVERVIEW, Linux Memory Types' for additional details.
When you've chosen to display command lines, processes without a command
line (like kernel threads) will be shown with only the program name in
brackets, as in this example:
This field may also be impacted by the forest view display mode.
See the `V' interactive command for additional information regarding that mode.
Note: The COMMAND field, unlike most columns, is not fixed-width.
When displayed, it plus any other variable width columns will be allocated
all remaining screen width (up to the maximum 512 characters).
Even so, such variable width fields could still suffer truncation.
This is especially true for this field when command lines are being
displayed (the `c' interactive command.)
See topic 5c. SCROLLING a Window for additional information on accessing
any truncated data.
See `OVERVIEW, Linux Memory Types' for additional details.
Note: The ENVIRON field, unlike most columns, is not fixed-width.
When displayed, it plus any other variable width columns will be allocated
all remaining screen width (up to the maximum 512 characters).
Even so, such variable width fields could still suffer truncation.
This is especially true for this field.
See topic 5c. SCROLLING a Window for additional information on accessing
any truncated data.
See the `'2' and `3' interactive commands for additional NUMA provisions affecting the summary area.
This value may also be used as: a process group ID (see PGRP);
a session ID for the session leader (see SID);
a thread group ID for the thread group leader (see TGID);
and a TTY process group ID for the process group leader (see TPGID).
Under linux, real time priority is somewhat misleading since traditionally
the operating itself was not preemptible.
And while the 2.6 kernel can be made mostly preemptible, it is not always so.
It can include private anonymous pages, private pages mapped to files
(including program images and shared libraries) plus shared anonymous pages.
All such memory is backed by the swap file represented separately under SWAP.
Lastly, this field may also include shared file-backed pages which, when
modified, act as a dedicated swap file and thus will never impact SWAP.
See `OVERVIEW, Linux Memory Types' for additional details.
Tasks shown as running should be more properly thought of as ready to run
-- their task_struct is simply represented on the Linux run-queue.
Even without a true SMP machine, you may see numerous tasks in this state
depending on top's delay interval and nice value.
See `OVERVIEW, Linux Memory Types' for additional details.
Note: The SUPGIDS field, unlike most columns, is not fixed-width.
When displayed, it plus any other variable width columns will be allocated
all remaining screen width (up to the maximum 512 characters).
Even so, such variable width fields could still suffer truncation.
See topic 5c. SCROLLING a Window for additional information on accessing
any truncated data.
Note: The SUPGRPS field, unlike most columns, is not fixed-width.
When displayed, it plus any other variable width columns will be allocated
all remaining screen width (up to the maximum 512 characters).
Even so, such variable width fields could still suffer truncation.
See topic 5c. SCROLLING a Window for additional information on accessing
any truncated data.
See `OVERVIEW, Linux Memory Types' for additional details.
See `OVERVIEW, Linux Memory Types' for additional details.
See `OVERVIEW, Linux Memory Types' for additional details.
This field was deprecated with linux 2.6 and is always zero.
The Fields Management screen can also be used to change the `current' window/field group in
either full-screen mode or alternate-display mode.
Whatever was targeted when `q' or <Esc> was pressed will be made current
as you return to the top display.
See topic 5. ALTERNATE-DISPLAY Provisions and the `g' interactive command for insight
into `current' windows and field groups.
Note: Any window that has been scrolled horizontally will be reset if any
field changes are made via the Fields Management screen.
Any vertical scrolled position, however, will not be affected.
See topic 5c. SCROLLING a Window for additional information regarding vertical
and horizontal scrolling.
If you wish to know in advance whether or not your top has been
secured, simply ask for help and view the system summary on the second
line.
Use either of these keys if you have a large delay interval and wish
to see current status,
Typing `h' or `?' on that help screen will take you to help for
those interactive commands applicable to alternate-display mode.
Additionally, if the window has been scrolled it will be reset with
this command.
Note: When this toggle is On and top is operating in monochrome mode,
the entire display will appear as normal text.
Thus, unless the `x' and/or `y' toggles are using reverse for emphasis,
there will be no visual confirmation that they are even on.
Fractional seconds are honored, but a negative number is not allowed.
Entering 0 causes (nearly) continuous updates, with an unsatisfactory
display as the system and tty driver try to keep up with top's demands.
The delay value is inversely proportional to system loading,
so set it with care.
If at any time you wish to know the current delay time, simply ask for
help and view the system summary on the second line.
If you see a `+' between a displayed number and the following label, it
means that top was forced to truncate some portion of that number.
By raising the scaling factor, such truncation can be avoided.
While top will try to honor the selected target range, additional
scaling might still be necessary in order to accommodate current values.
If you wish to see a more homogeneous result in the memory columns,
raising the scaling range will usually accomplish that goal.
Raising it too high, however, is likely to produce an all zero result
which cannot be suppressed with the `0' interactive command.
Entering no PID or a negative number will be interpreted as
the default shown in the prompt (the first task displayed).
A PID value of zero means the top program itself.
The default signal, as reflected in the prompt, is SIGTERM.
However, you can send any signal, via number or name.
If you wish to abort the kill process, do one of the following
depending on your progress:
Entering no PID or a negative number will be interpreted as
the default shown in the prompt (the first task displayed).
A PID value of zero means the top program itself.
A positive nice value will cause a process to lose priority.
Conversely, a negative nice value will cause a process to be viewed
more favorably by the kernel.
As a general rule, ordinary users can only increase the nice value
and are prevented from lowering it.
If you wish to abort the renice process, do one of the following
depending on your progress:
This interactive command can be used to alter the widths of the following fields:
You will be prompted for the amount to be added to the default
widths shown above.
Entering zero forces a return to those defaults.
If you enter a negative number, top will automatically increase
the column size as needed until there is no more truncated data.
You can accelerate this process by reducing the delay interval
or holding down the <Space> bar.
Note: Whether explicitly or automatically increased, the widths for
these fields are never decreased by top.
To narrow them you must specify a smaller number or restore the defaults.
Note: This interactive command is only fully realized when supporting entries have been
manually added to the end of the top configuration file.
For details on creating those entries, see topic 6b. ADDING INSPECT Entries.
Most of the keys used to navigate the Inspect feature are reflected in
its header prologue.
There are, however, additional keys available once you have selected a
particular file or command.
They are familiar to anyone who has used the pager `less' and are
summarized here for future reference.
These commands always impact just the `current' window/field group.
See topic 5. ALTERNATE-DISPLAY Provisions and the `g' interactive command for insight into
`current' windows and field groups.
This portion of the summary area is also influenced by the `H' interactive command toggle,
as reflected in the total label which shows either Tasks or Threads.
This command serves as a 4-way toggle, cycling through these modes:
When operating in either of the graphic modes, the display becomes much
more meaningful when individual CPUs or NUMA nodes are also displayed.
See the the `1', `2' and `3' commands below for additional information.
This command serves as a 4-way toggle, cycling through these modes:
When you see `%Cpu(s):' in the summary area, the `1' toggle is On and all
cpu information is gathered in a single line.
Otherwise, each cpu is displayed separately as: `%Cpu0, %Cpu1, ...'
up to available screen height.
To avoid truncation when displaying detailed cpu statistcs,
as opposed to the graphic representations, a minimum width
of 165 columns would be required.
For example, with the first press of `!' one additional cpu will be
combined and displayed as `0-1, 2-3, ...' instead of the normal
`%Cpu0, %Cpu1, %Cpu2, %Cpu3, ...'.
With a second `!' command toggle two additional cpus are combined and shown
as `0-2, 3-5, ...'.
Then the third '!' press, combining four additional cpus, shows
as `0-4, 5-9, ...', etc.
Such progression continues until individual cpus are again displayed
and impacts both the `1' and `4' toggles (one or two columns).
Use the `=' command to exit Combine Cpus mode.
Note: If the entire summary area has been toggled Off for any window, you would
be left with just the message line.
In that way, you will have maximized available task rows but (temporarily)
sacrificed the program name in full-screen mode or the `current' window name when in alternate-display mode.
The task area interactive commands are never available in alternate-display mode if the `current' window's
task display has been toggled Off (see topic 5. ALTERNATE-DISPLAY Provisions).
APPEARANCE of task window
Note: Whenever Searching and/or Other Filtering is active in a window,
column highlighting is temporarily disabled.
See the notes at the end of topics 5d. SEARCHING and 5e. FILTERING for an
explanation why.
Use of this provision provides important insight into your system's health.
The only costs will be a few additional tty escape sequences.
CONTENT of task window
See topic 5e. FILTERING in a window for details on these and additional
related interactive commands.
When Off, programs that fork into many separate tasks will appear
less demanding.
For programs like `init' or a shell this is appropriate but for others,
like compilers, perhaps not.
Experiment with two task windows sharing the same sort field but with different `S'
states and see which representation you prefer.
After issuing this command, you'll be informed of the new state of this toggle.
If you wish to know in advance whether or not Cumulative mode is in
effect, simply ask for help and view the window summary on the second line.
Thereafter, in that task window only matching users will be shown, or possibly
no processes will be shown.
Prepending an exclamation point (`!') to the user id or name instructs top
to display only processes with users not matching the one provided.
Different task windows can be used to filter different users.
Later, if you wish to monitor all users again in the `current' window, re-issue this
command but just press <Enter> at the prompt.
Note: Typing any key affecting the sort order will exit forest view
mode in the `current' window.
See topic 4c. TASK AREA Commands, SORTING for information on those keys.
The toggle is applied against the first (topmost) process in the `current' window.
See topic 5c. SCROLLING a Window for additional information regarding
vertical scrolling.
If the target process has not forked any children, this key has no effect.
It also has no effect when not in forest view mode.
SIZE of task window
If this command is applied to the last task display when in alternate-display mode, then it will not
affect the window's size, as all prior task displays will have already been painted.
When used in alternate-display mode, this is the command that gives you precise control over
the size of each currently visible task display, except for the very last.
It will not affect the last window's size, as all prior task displays will have
already been painted.
Note: If you wish to increase the size of the last visible task display when in alternate-display mode,
simply decrease the size of the task display(s) above it.
SORTING of task window
Before using any of the following sort provisions, top suggests that you
temporarily turn on column highlighting using the `x' interactive command.
That will help ensure that the actual sort environment matches your intent.
The following interactive commands will only be honored when the current sort field
is visible.
The sort field might not be visible because:
The following interactive commands will always be honored whether or not
the current sort field is visible.
Note: Field sorting uses internal values, not those in column display.
Thus, the TTY and WCHAN fields will violate strict ASCII collating sequence.
The following interactive commands are available.
If you use `a' or `w' to cycle the targeted window, you will
have applied the color scheme that was displayed when you left that window.
You can, of course, easily return to any window and reapply different
colors or turn colors Off completely with the `z' toggle.
The Color Mapping screen can also be used to change the `current' window/field group in
either full-screen mode or alternate-display mode.
Whatever was targeted when `q' or <Enter> was pressed will be made current
as you return to the top display.
In alternate-display mode, those 4 underlying field groups can now be made visible
simultaneously, or can be turned Off individually at your command.
The summary area will always exist, even if it's only the message line.
At any given time only one summary area can be displayed.
However, depending on your commands, there could be from zero
to four separate task displays currently showing on the screen.
A further complication arises when you have toggled the first summary area
line Off.
With the loss of the window name (the `l' toggled line), you'll not easily
know what window is the `current' window.
The `_' key does the same for all task displays.
In other words, it switches between the currently visible task display(s) and any
task display(s) you had toggled Off.
If all 4 task displays are currently visible, this interactive command will leave the summary area
as the only display element.
The `+' key does the same for all windows.
The four task displays will reappear, evenly balanced, while retaining
any customizations previously applied beyond those noted
for the `=' command toggle.
The first time you issue this command, all four task displays will be shown.
Thereafter when you switch modes, you will see only the task display(s) you've
chosen to make visible.
Assuming the window name is visible (you have not toggled `l' Off),
whenever the `current' window name loses its emphasis/color, that's a reminder
the task display is Off and many commands will be restricted.
In full-screen mode, this command is necessary to alter the `current' window.
In alternate-display mode, it is simply a less convenient alternative to the `a' and `w'
commands.
Note: As a reminder, some fields/columns are not fixed-width but
allocated all remaining screen width when visible.
When scrolling right or left, that feature may produce some
unexpected results initially.
Additionally, there are special provisions for any variable width field
when positioned as the last displayed field.
Once that field is reached via the right arrow key, and is thus the only
column shown, you can continue scrolling horizontally within such a field.
See the `C' interactive command below for additional information.
Note: From this position it is still possible to scroll down
and right using the arrow keys.
This is true until a single column and a single task is left as the only
display element.
The coordinates shown as n/n are relative to the upper left
corner of the `current' window.
The additional `+ nn' represents the displacement into a variable
width column when it has been scrolled horizontally.
Such displacement occurs in normal 8 character tab stop amounts via
the right and left arrow keys.
The above interactive commands are always available in full-screen mode but never
available in alternate-display mode if the `current' window's task display has been toggled Off.
Note: When any form of filtering is active, you can expect some slight
aberrations when scrolling since not all tasks will be visible.
This is particularly apparent when using the Up/Down arrow keys.
Searches are not limited to values from a single field or column.
All of the values displayed in a task row are allowed in a search string.
You may include spaces, numbers, symbols and even forest view artwork.
Keying <Enter> with no input will effectively disable the `&' key until
a new search string is entered.
When a match is found, the current window is repositioned vertically so the
task row containing that string is first.
The scroll coordinates message can provide confirmation of such vertical
repositioning (see the `C' interactive command).
Horizontal scrolling, however, is never altered via searching.
The availability of a matching string will be influenced by the following
factors.
If a search fails, restoring the `current' window home (unscrolled) position, scrolling
horizontally, displaying command-lines or choosing a more stable sort field
could yet produce a successful `&' search.
The above interactive commands are always available in full-screen mode but never
available in alternate-display mode if the `current' window's task display has been toggled Off.
Note: Whenever a Search is active in a window, top will turn
column highlighting Off to prevent false matches on internal non-display
escape sequences.
Such highlighting will be restored when a window's search string is empty.
See the `x' interactive command for additional information on sort column highlighting.
Establishing a filter requires: 1) a field name; 2) an operator; and
3) a selection value, as a minimum.
This is the most complex of top's user input requirements so, when you make
a mistake, command recall will be your friend.
Remember the Up/Down arrow keys or their aliases when prompted for input.
Filter Basics
If a field is not turned on or is not currently in view, then your selection
criteria will not affect the display.
Later, should a filtered field become visible, the selection criteria will
then be applied.
Keyboard Summary
Input Requirements
When prompted for selection criteria, the data you provide must take one
of two forms.
There are 3 required pieces of information, with a 4th as optional.
These examples use spaces for clarity but your input generally would not.
Items #1, #3 and #4 should be self-explanatory.
Item #2 represents both a required delimiter and the operator
which must be one of either equality (`=') or relation (`<' or `>').
The `=' equality operator requires only a partial match and that
can reduce your `if-value' input requirements.
The `>' or `<' relational operators always employ string comparisons,
even with numeric fields.
They are designed to work with a field's default justification and
with homogeneous data.
When some field's numeric amounts have been subjected to scaling
while others have not, that data is no longer homogeneous.
If you establish a relational filter and you have changed the
default Numeric or Character justification, that filter is likely to fail.
When a relational filter is applied to a memory field and you have not
changed the scaling, it may produce misleading results.
This happens, for example, because `100.0m' (MiB) would appear greater
than `1.000g' (GiB) when compared as strings.
If your filtered results appear suspect, simply altering justification or
scaling may yet achieve the desired objective.
See the `j', `J' and `e' interactive commands for additional information.
Potential Problems
These GROUP filters could produce the exact same results or the
second one might not display anything at all, just a blank task window.
Either of these RES filters might yield inconsistent and/or
misleading results, depending on the current memory scaling factor.
Or both filters could produce the exact same results.
This nMin filter illustrates a problem unique to scalable fields.
This particular field can display a maximum of 4 digits, beyond which values
are automatically scaled to KiB or above.
So while amounts greater than 9999 exist, they will appear as 2.6m, 197k, etc.
Potential Solutions
These examples illustrate how Other Filtering can be creatively
applied to achieve almost any desired result.
Single quotes are sometimes shown to delimit the spaces which are part of
a filter or to represent a request for status (^O) accurately.
But if you used them with if-values in real life, no matches would be found.
Assuming field nTH is displayed, the first filter will result in
only multi-threaded processes being shown.
It also reminds us that a trailing space is part of every displayed field.
The second filter achieves the exact same results with less typing.
With Forest View mode active and the COMMAND column in view, this
filter effectively collapses child processes so that just 3 levels are shown.
The final two filters appear as in response to the status request key (^O).
In reality, each filter would have required separate input.
The PR example shows the two concurrent filters necessary to display
tasks with priorities of 20 or more, since some might be negative.
Then by exploiting trailing spaces, the nMin series of filters could
achieve the failed `9999' objective discussed above.
Note: Whenever Other Filtering is active in a window, top will turn
column highlighting Off to prevent false matches on internal non-display
escape sequences.
Such highlighting will be restored when a window is no longer subject
to filtering.
See the `x' interactive command for additional information on sort column highlighting.
The legacy version is written as `$HOME/.your-name-4-top' + `rc'
with a leading period.
A newly created configuration file is written as procps/your-name-4-top' + `rc'
without a leading period.
The procps directory will be subordinate to either $XDG_CONFIG_HOME when
set as an absolute path or the $HOME/.config directory.
While not intended to be edited manually, here is the general layout:
If a valid absolute path to the rcfile cannot be established, customizations
made to a running top will be impossible to preserve.
If you don't know the location or name of your top rcfile, use the `W'
interactive command to rewrite it and note those details.
Inspect entries can be added with a redirected echo or by editing the configuration file.
Redirecting an echo risks overwriting the rcfile should it replace (>)
rather than append (>>) to that file.
Conversely, when using an editor care must be taken not to corrupt existing
lines, some of which will contain unprintable data or unusual characters.
Those Inspect entries beginning with a `#' character are ignored, regardless
of content.
Otherwise they consist of the following 3 elements, each of which must
be separated by a tab character (thus 2 `\t' total):
The two types of Inspect entries are not interchangeable.
Those designated `file' will be accessed using fopen and
must reference a single file in the `.fmts' element.
Entries specifying `pipe' will employ popen, their `.fmts' element
could contain many pipelined commands and, none can be interactive.
If the file or pipeline represented in your `.fmts' deals with the specific PID
input or accepted when prompted, then the format string must also contain
the `%d' specifier, as these examples illustrate.
For `pipe' type entries only, you may also wish to redirect stderr to
stdout for a more comprehensive result.
Thus the format string becomes:
Here are examples of both types of Inspect entries as they might appear
in the rcfile.
The first entry will be ignored due to the initial `#' character.
For clarity, the pseudo tab depictions (^I) are surrounded by an
extra space but the actual tabs would not be.
Except for the commented entry above, these next examples show what could
be echoed to achieve similar results, assuming the rcfile name was `.toprc'.
However, due to the embedded tab characters, each of these lines should be
preceded by `/bin/echo -e', not just a simple an `echo', to
enable backslash interpretation regardless of which shell you use.
If any inspect entry you create produces output with unprintable characters
they will be displayed in either the ^C notation or hexadecimal <FF> form,
depending on their value.
This applies to tab characters as well, which will show as `^I'.
If you want a truer representation, any embedded tabs should be expanded.
The following example takes what could have been a `file' entry but employs
a `pipe' instead so as to expand the embedded tabs.
Note: Some programs might rely on SIGINT to end.
Therefore, if a `pipe' such as the following is established, one must
use Ctrl-C to terminate it in order to review the results.
This is the single occasion where a `^C' will not also terminate top.
Lastly, while `pipe' type entries have been discussed in terms of pipelines
and commands, there is nothing to prevent you from including shell scripts
as well.
Perhaps even newly created scripts designed specifically for the `Y' interactive command.
For example, as the number of your Inspect entries grows over time, the `Options:'
row will be truncated when screen width is exceeded.
That does not affect operation other than to make some selections invisible.
However, if some choices are lost to truncation but you want to see more options,
there is an easy solution hinted at below.
The entries in the top rcfile would have a number for the `.name' element and
the `help' entry would identify a shell script you've written explaining what
those numbered selections actually mean.
In that way, many more choices can be made visible.
Creating it is a simple process.
1. Configure top appropriately for your installation and preserve that
configuration with the `W' interactive command.
2. Add and test any desired `inspect' entries.
3. Copy that configuration file to the /etc/ directory as `topdefaultrc'.
More importantly, it will limit what ordinary users are allowed
to do when top is running.
They will not be able to issue the following commands.
This configuration file is not created by top.
Rather, it is created manually and placed it in the /etc/
directory as `toprc'.
It should have exactly two lines, as shown in this example:
For this experiment, under x-windows open an xterm and maximize it.
Then do the following:
What you'll see is a very busy Linux doing what he's always done for you,
but there was no program available to illustrate this.
After bringing the most active processes into view, what you'll see are
the ghostly images of just the currently running tasks.
Your display will be refreshed at three times the rate of the former top,
a 300% speed advantage.
As top climbs the TIME ladder, be as patient as you can while speculating
on whether or not top will ever reach the top.
When they've all been displaced, toggle between all visible/invisible windows
using the `_' command toggle.
Then ponder this:
Then use the up/down arrow keys to position the display so that some
truncated command lines are shown (`+' in last position).
You may have to resize your xterm to produce truncation.
Lastly, use the `j' command toggle to make the COMMAND column right justified.
Now use the right arrow key to reach the COMMAND column.
Continuing with the right arrow key, watch closely the direction
of travel for the command lines being shown.
k - kibibytes
m - mebibytes
g - gibibytes
t - tebibytes
p - pebibytes
k - kibibytes
m - mebibytes
g - gibibytes
t - tebibytes
p - pebibytes
e - exbibytes
2. SUMMARY Display
Each of the following three areas are individually controlled through
one or more interactive commands.
See topic 4b. SUMMARY AREA Commands for additional information regarding
these provisions.
2a. UPTIME and LOAD Averages
This portion consists of a single line containing:
program or window name, depending on display mode
current time and length of time since last boot
total number of users
system load avg over the last 1, 5 and 15 minutes
2b. TASK and CPU States
This portion consists of a minimum of two lines.
In an SMP environment, additional lines can reflect individual CPU
state percentages.
running; sleeping; stopped; zombie
us, user : time running un-niced user processes
sy, system : time running kernel processes
ni, nice : time running niced user processes
id, idle : time spent in the kernel idle handler
wa, IO-wait : time waiting for I/O completion
hi : time spent servicing hardware interrupts
si : time spent servicing software interrupts
st : time stolen from this vm by the hypervisor
a b c d
%Cpu(s): 75.0/25.0 100[ ...
2c. MEMORY Usage
This portion consists of two lines which may express values in kibibytes (KiB)
through exbibytes (EiB) depending on the scaling factor enforced
with the `E' interactive command.
total, free, used and buff/cache
total, free, used and avail (which is physical memory)
a b c
GiB Mem : 18.7/15.738 [ ...
GiB Swap: 0.0/7.999 [ ...
KiB = kibibyte = 1024 bytes
MiB = mebibyte = 1024 KiB = 1,048,576 bytes
GiB = gibibyte = 1024 MiB = 1,073,741,824 bytes
TiB = tebibyte = 1024 GiB = 1,099,511,627,776 bytes
PiB = pebibyte = 1024 TiB = 1,125,899,906,842,624 bytes
EiB = exbibyte = 1024 PiB = 1,152,921,504,606,846,976 bytes
3. FIELDS / Columns
3a. DESCRIPTIONS of Fields
Listed below are top's available process fields (columns).
They are shown in strict ascii alphabetical order.
You may customize their position and whether or not they are displayable
with the `f' or `F' (Fields Management) interactive commands.
1. %CPU
2. %MEM
3. CGNAME
4. CGROUPS
5. CODE
6. COMMAND
7. DATA
8. ENVIRON
9. Flags
3b. MANAGING Fields
After pressing the interactive command `f' or `F' (Fields Management) you will be presented
with a screen showing: 1) the `current' window name; 2) the designated sort field;
3) all fields in their current order along with descriptions.
Entries marked with an asterisk are the currently displayed fields,
screen width permitting.
4. INTERACTIVE Commands
Listed below is a brief index of commands within categories.
Some commands appear more than once -- their meaning or scope may vary
depending on the context in which they are issued.
4a. Global-Commands
<Ent/Sp> ?, =, 0,
A, B, d, E, e, g, h, H, I, k, q, r, s, W, X, Y, Z
4b. Summary-Area-Commands
C, l, t, m, 1, 2, 3, 4, !
4c. Task-Area-Commands
Appearance: b, J, j, x, y, z
Content: c, f, F, o, O, S, u, U, V, v
Size: #, i, n
Sorting: <, >, f, F, R
4d. Color-Mapping
<Ret>, a, B, b, H, M, q, S, T, w, z, 0 - 7
5b. Commands-for-Windows
-, _, =, +, A, a, g, G, w
5c. Scrolling-a-Window
C, Up, Dn, Left, Right, PgUp, PgDn, Home, End
5d. Searching-in-a-Window
L, &
4a. GLOBAL Commands
The global interactive commands are always available in both full-screen mode and alternate-display mode.
However, some of these interactive commands are not available when running
in Secure mode.
1) at the pid prompt, type an invalid number
2) at the signal prompt, type 0 (or any invalid signal)
3) at any prompt, type <Esc>
1) at the pid prompt, type an invalid number
2) at the nice prompt, type <Enter> with no input
3) at any prompt, type <Esc>
field default field default field default
GID 5 GROUP 8 WCHAN 10
RUID 5 LXC 8 nsIPC 10
SUID 5 RUSER 8 nsMNT 10
UID 5 SUSER 8 nsNET 10
TTY 8 nsPID 10
USER 8 nsUSER 10
nsUTS 10
key function
= alternate status-line, file or pipeline
/ find, equivalent to `L' locate
n find next, equivalent to `&' locate next
<Space> scroll down, equivalent to <PgDn>
b scroll up, equivalent to <PgUp>
g first line, equivalent to <Home>
G last line, equivalent to <End>
4b. SUMMARY AREA Commands
The summary area interactive commands are always available in both full-screen mode and alternate-display mode.
They affect the beginning lines of your display and will determine the
position of messages and prompts.
1. detailed percentages by category
2. abbreviated user/system and total % + bar graph
3. abbreviated user/system and total % + block graph
4. turn off task and cpu states display
1. detailed percentages by memory type
2. abbreviated % used/total available + bar graph
3. abbreviated % used/total available + block graph
4. turn off memory display
4c. TASK AREA Commands
The task area interactive commands are always available in full-screen mode.
command sorted-field supported
A start time (non-display) No
M %MEM Yes
N PID Yes
P %CPU Yes
T TIME+ Yes
4d. COLOR Mapping
When you issue the `Z' interactive command, you will be presented with a separate screen.
That screen can be used to change the colors in just the `current' window or
in all four windows before returning to the top display.
4 upper case letters to select a target
8 numbers to select a color
normal toggles available
B :bold disable/enable
b :running tasks "bold"/reverse
z :color/mono
other commands available
a/w :apply, then go to next/prior
<Enter> :apply and exit
q :abandon current changes and exit
5. ALTERNATE-DISPLAY Provisions
5a. WINDOWS Overview
5b. COMMANDS for Windows
=, A, g are always available
a, w act the same with color mapping
and fields management
5c. SCROLLING a Window
Typically a task window is a partial view into a systems's total tasks/threads
which shows only some of the available fields/columns.
With these scrolling keys, you can move that view vertically or horizontally to
reveal any desired task or column.
scroll coordinates: y = n/n (tasks), x = n/n (fields)
scroll coordinates: y = n/n (tasks), x = n/n (fields) + nn
5d. SEARCHING in a Window
You can use these interactive commands to locate a task row containing a particular value.
5e. FILTERING in a Window
You can use this `Other Filter' feature to establish selection criteria which
will then determine which tasks are shown in the `current' window.
Such filters can be made presistent if preserved in the rcfile via
the 'W' interactive command.
#1 #2 #3 ( required )
Field-Name ? include-if-value
! Field-Name ? exclude-if-value
#4 ( optional )
GROUP=root ( only the same results when )
GROUP=ROOT ( invoked via lower case `o' )
RES>9999 ( only the same results when )
!RES<10000 ( memory scaling is at `KiB' )
nMin>9999 ( always a blank task window )
!nTH=` 1 ' ( ' for clarity only )
nTH>1 ( same with less i/p )
!COMMAND=` `- ' ( ' for clarity only )
`PR>20' + `!PR=-' ( 2 for right result )
`!nMin=0 ' + `!nMin=1 ' + `!nMin=2 ' + `!nMin=3 ' ...
6. FILES
6a. PERSONAL Configuration File
This file is created or updated via the 'W' interactive command.
global # line 1: the program name/alias notation
" # line 2: id,altscr,irixps,delay,curwin
per ea # line a: winname,fieldscur
window # line b: winflags,sortindx,maxtasks,etc
" # line c: summclr,msgsclr,headclr,taskclr
global # line 15: additional miscellaneous settings
" # any remaining lines are devoted to optional
" # active 'other filters' discussed in section 5e above
" # plus 'inspect' entries discussed in section 6b below
6b. ADDING INSPECT Entries
To exploit the `Y' interactive command, you must add entries at the end of the
top personal configuration file.
Such entries simply reflect a file to be read or command/pipeline to be
executed whose results will then be displayed in a separate scrollable,
searchable window.
.type: literal `file' or `pipe'
.name: selection shown on the Inspect screen
.fmts: string representing a path or command
.fmts= /proc/%d/numa_maps
.fmts= lsof -P -p %d
.fmts= pmap -x %d 2>&1
# pipe ^I Sockets ^I lsof -n -P -i 2>&1
pipe ^I Open Files ^I lsof -P -p %d 2>&1
file ^I NUMA Info ^I /proc/%d/numa_maps
pipe ^I Log ^I tail -n100 /var/log/syslog | sort -Mr
"pipe\tOpen Files\tlsof -P -p %d 2>&1" >> ~/.toprc
"file\tNUMA Info\t/proc/%d/numa_maps" >> ~/.toprc
"pipe\tLog\ttail -n200 /var/log/syslog | sort -Mr" >> ~/.toprc
# next would have contained `\t' ...
# file ^I <your_name> ^I /proc/%d/status
# but this will eliminate embedded `\t' ...
pipe ^I <your_name> ^I cat /proc/%d/status | expand -
pipe ^I Trace ^I /usr/bin/strace -p %d 2>&1
Inspection Pause at pid ...
Use: left/right then <Enter> ...
Options: help 1 2 3 4 5 6 7 8 9 10 11 ...
6c. SYSTEM Configuration File
This configuration file represents defaults for users who have not saved their own configuration file.
The format mirrors exactly the personal configuration file and can also include `inspect'
entries as explained above.
6d. SYSTEM Restrictions File
The presence of this file will influence which version of the help screen
is shown to an ordinary user.
k Kill a task
r Renice a task
d or s Change delay/sleep interval
s # line 1: secure mode switch
5.0 # line 2: delay interval in seconds
7. STUPID TRICKS Sampler
Many of these tricks work best when you give top a scheduling boost.
So plan on starting him with a nice value of -10, assuming you've got
the authority.
7a. Kernel Magic
For these stupid tricks, top needs full-screen mode.
. provide a scheduling boost and tiny delay via:
nice -n -10 top -d.09
. keep sorted column highlighting Off so as to
minimize path length
. turn On reverse row highlighting for emphasis
. try various sort columns (TIME/MEM work well),
and normal or reverse sorts to bring the most
active processes into view
7b. Bouncing Windows
For these stupid tricks, top needs alternate-display mode.
7c. The Big Bird Window
This stupid trick also requires alternate-display mode.
7d. The Ol' Switcheroo
This stupid trick works best without alternate-display mode, since justification is active
on a per window basis.
8. BUGS
Please send bug reports to
9. SEE Also
free(1),
ps(1),
uptime(1),
atop(1),
slabtop(1),
vmstat(8),
w(1)