top is available on every Linux server and shows, live, what the system is doing: load, CPU, memory and the busiest processes. Knowing how to read its header is half of performance troubleshooting.

top

Press q to quit.

The header, line by line

top - 10:42:13 up 12 days,  3:01,  1 user,  load average: 0.84, 0.72, 0.65
Tasks: 142 total,   1 running, 141 sleeping,   0 stopped,   0 zombie
%Cpu(s):  6.1 us,  1.8 sy,  0.0 ni, 91.2 id,  0.6 wa,  0.0 hi,  0.1 si,  0.2 st
MiB Mem :   3936.0 total,    214.5 free,   1452.3 used,   2269.2 buff/cache
MiB Swap:   2048.0 total,   2018.4 free,     29.6 used.   2148.7 avail Mem

Load average

Three numbers: the average number of processes running or waiting to run (including those waiting for disk I/O) over the last 1, 5 and 15 minutes. Compare with the number of CPU cores (nproc):

  • Below the core count — the CPU keeps up.
  • Consistently above — work is queuing.

On a 2-core VPS, a load of 0.8 is relaxed; 6 is overloaded. See load average explained.

Tasks

Counts of processes by state. A growing number of zombies means a parent process isn’t cleaning up its children — see zombie processes.

CPU states — the most useful line

Field Meaning If high
us User-space programs Your apps are busy (normal under load)
sy Kernel Lots of system calls, networking, context switches
ni Low-priority (niced) processes Background jobs
id Idle —
wa Waiting for I/O Disk is the bottleneck — see iostat
hi / si Hardware / software interrupts High network packet rates
st Steal — time the hypervisor gave to other VMs Host contention on a VPS

st exists only in virtual machines. A few percent occasionally is normal; a consistently high value means the host is oversubscribed — see CPU steal time.

Press 1 to show each CPU core separately — useful to spot a single-threaded process maxing out one core while the average looks fine.

Memory

The same numbers as free. Focus on avail Mem, not “free”: Linux uses spare RAM for cache. See the free command.

The process list

Column Meaning
PID Process ID
USER Owner
PR / NI Priority / nice value
VIRT Virtual memory (includes mapped, unused space — rarely meaningful)
RES Resident memory — physical RAM in use
SHR Shared memory part of RES
S State: R running, S sleeping, D uninterruptible (usually I/O), Z zombie
%CPU CPU share since last refresh (can exceed 100% on multi-core)
%MEM RES as % of total RAM
TIME+ Total CPU time consumed
COMMAND Program name

Many processes in state D together with high wa point to a storage bottleneck.

Interactive keys

Key Action
P Sort by CPU (default)
M Sort by memory
T Sort by cumulative time
1 Toggle per-CPU view
c Show full command lines
u Filter by user
o Add a filter, e.g. COMMAND=php
k Kill a process (asks for PID and signal)
r Renice a process
H Show threads instead of processes
d Change refresh interval
W Save the current layout to ~/.config/procps/toprc
q Quit

Command-line options

top -u www-data           # one user's processes
top -p 1234,5678          # specific PIDs
top -d 2                  # refresh every 2 seconds
top -o %MEM               # start sorted by memory

Batch mode for scripts and logs

top -b -n 1 | head -20                      # one snapshot
top -b -n 1 -o %MEM | head -20 > /tmp/top-$(date +%H%M).txt

Capture snapshots from cron during a recurring slowdown to see what was running at the time.

A quick diagnosis routine

  1. Load vs cores — overloaded or not?
  2. CPU line: high us/sy → CPU-bound; high wa → disk-bound; high st → noisy host.
  3. Memory: low avail Mem and swap growing → memory-bound.
  4. Sort by CPU (P) and memory (M) to find the responsible process.
  5. Press c to see its full command line (which PHP pool, which script).

Alternatives

  • htop — colourful, scrollable, mouse support, tree view.
  • atop — records history, so you can see what happened at 3 a.m.
  • btop — modern dashboard with graphs.
  • vmstat, iostat — focused numbers over time.

top is always there, even on a minimal server in rescue mode — worth knowing well. See also ps for one-off process listings.

  • Linux
  • Performance
  • Monitoring