Chapter 28: Bash List Processes (top)
What is top? (super simple first)
top = shows a live, updating view of all running processes on your Linux system + summary information about CPU, memory, swap, tasks, load average.
It’s the most popular interactive process viewer – like Task Manager on Windows, but much more powerful and lightweight.
Key differences from ps:
- ps → one-time photo (static snapshot)
- top → live video (refreshes every ~3 seconds by default)
You run it, it stays open, updates automatically, and you can interact with it (sort, kill, change view, etc.).
Most people use top daily to:
- See which program is eating CPU / RAM right now
- Find hung / zombie processes
- Check system load when something feels slow
- Quickly kill a bad process
- Watch memory / swap usage live
1. Just run it (try right now!)
Bash
|
0 1 2 3 4 5 6 |
top |
You will see something like this (example from a typical laptop):
text
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
top - 15:48:22 up 2 days, 3:12, 2 users, load average: 0.85, 0.60, 0.45 Tasks: 320 total, 1 running, 319 sleeping, 0 stopped, 0 zombie %Cpu(s): 4.2 us, 2.1 sy, 0.0 ni, 93.1 id, 0.5 wa, 0.0 hi, 0.1 si, 0.0 st MiB Mem : 15872.4 total, 2456.7 free, 8923.1 used, 4492.6 buff/cache MiB Swap: 2048.0 total, 2048.0 free, 0.0 used. 6123.4 avail Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2345 arman 20 0 2456789 456789 12345 S 8.5 2.9 12:34.56 firefox 5678 arman 20 0 1890123 345678 23456 S 4.2 2.2 5:12.89 code 9012 root 20 0 456789 78901 34567 S 1.1 0.5 8:45.23 Xorg 34567 arman 20 0 1234567 234567 45678 S 0.8 1.5 3:21.09 python3 ... |
2. Understand every part of the screen (very important!)
First 5 summary lines:
-
top – time up days,hours:min, users, load average: 1min 5min 15min
- load average 0.85 0.60 0.45 → good (below number of CPU cores = relaxed)
- 3.2 4.1 5.0 → overloaded (system struggling)
-
Tasks: total / running / sleeping / stopped / zombie
- zombie = dead but parent didn’t collect → bad sign
-
%Cpu(s): us (user/apps), sy (system/kernel), ni (nice/low prio), id (idle), wa (waiting for disk I/O), hi/si (hardware/software interrupts), st (steal – virtual machine)
- High id (90%+) = idle & happy
- High wa = disk bottleneck (slow HDD/SSD/full disk)
-
MiB Mem / MiB Swap
- total / free / used / buff/cache
- avail Mem = what you can still use comfortably
- Swap used > 0 → RAM is full → slow system
-
Process list columns (most important!)
| Column | Meaning | Good value example | When to worry |
|---|---|---|---|
| PID | Process ID | 12345 | To kill it |
| USER | Who owns the process | arman, root | Unknown user? |
| PR / NI | Priority / Nice value | 20 / 0 | -20 = highest prio |
| VIRT | Virtual memory (total allocated) | 2.4g | Big is ok |
| RES | Resident memory (real RAM used) | 456m | High = eating RAM |
| SHR | Shared memory | 123m | Libraries |
| S | State (R=run, S=sleep, D=uninterruptible, Z=zombie, T=stopped) | S (sleeping) most common | Z or D = problem |
| %CPU | CPU usage this update | 12.5 | 100% = busy |
| %MEM | RAM usage % | 4.2 | >10–20% suspicious |
| TIME+ | Total CPU time used since start | 45:12.34 | Very high = long runner |
| COMMAND | Name of the command | firefox-bin | Identify culprit |
3. Most useful keys inside top (learn these!)
| Key | What it does | When to use |
|---|---|---|
| q | Quit | Finish |
| 1 | Show each CPU core separately | Multi-core laptop/server |
| Shift+P | Sort by %CPU (default) | Find CPU eater |
| Shift+M | Sort by %MEM | Find RAM eater |
| Shift+T | Sort by TIME+ (longest running) | Old processes |
| k | Kill process (type PID, then signal) | Kill hung app |
| r | Renice (change priority) | Lower prio of bad process |
| f | Field management (add/remove/sort columns) | Customize view |
| z | Toggle color/monochrome | Easier reading |
| c | Toggle full command line vs name | See full path/args |
| Shift+C | Toggle highlight of changed lines | See what changed |
| d or s | Change refresh delay (default 3s) | Slower = less CPU use |
| Shift+W | Save current settings to ~/.toprc | Remember layout |
4. Real-life examples you will use daily
Bash
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
# Start top sorted by memory (most common first action) top -o %MEM # Only show your processes top -u arman # Run top in batch mode (for scripts / non-interactive) top -b -n 1 -o %CPU > top-snapshot.txt # Watch only one process live (e.g. PID 12345) top -p 12345 # Combine with watch for slower refresh watch -n 5 top -b -n 1 # See only processes with "python" (trick to avoid grep self) top -p $(pgrep python) |
5. Quick cheat-sheet table
| Goal | How to do it in top | Notes |
|---|---|---|
| See live CPU/RAM/processes | Just run top | Default view |
| Sort by CPU usage | Press Shift+P | Default actually |
| Sort by memory usage | Press Shift+M | Very common |
| Kill a process | Press k → type PID → Enter → 15 or 9 | 15 = gentle, 9 = force |
| Show per-core CPU | Press 1 | Multi-core systems |
| See full command line | Press c | See arguments |
| Save your favorite view | Customize → Shift+W | ~/.toprc |
| Only your user | top -u $USER | Cleaner |
| Batch / script snapshot | top -b -n 1 > snapshot.txt | Automation |
6. Pro tips & next steps
- If top feels old → install htop or btop (much prettier)
Bash01234567sudo apt install htop # or btophtop
- High wa in %Cpu → check disk with iostat -x 1
- Swap used a lot → you need more RAM or close heavy apps
- Load average > number of cores for long time → system overloaded
Now open your terminal and try:
Bash
|
0 1 2 3 4 5 6 7 |
top # Then inside: press 1, Shift+M, look around, press q to quit |
Tell me:
- What’s your current load average? (e.g. 0.45 0.32 0.28)
- Which process is using the most %CPU or %MEM right now?
Or ask:
- “How to kill a process from top safely?”
- “What does high wa mean and how to fix?”
- “htop vs top vs glances – which one should I use?”
We’ll go deeper together! 😄
