top is the live view of your machine: processes refreshing every few seconds, sorted by whatever is hurting at the moment. When a laptop fan spins up or a server slows down, top is usually the first window opened — and the only one needed half the time.
Reading the header #
The first five lines summarise the system:
- load averages (
0.42, 0.31, 0.28) — demand over 1, 5, and 15 minutes. Rule of thumb: persistently above your CPU core count means work is queued. - %Cpu(s) — where cycles go:
ususer,sysystem,ididle,wawaiting on disk. - MiB Mem / Swap — RAM and swap pressure. Swap climbing while memory is full is the classic "the machine is thrashing" signature.
The interactive keys #
| Key | Action |
|---|---|
M | Sort by memory |
P | Sort by CPU |
k | Kill a process — asks for a PID and signal |
u | Filter to one user |
1 | Expand each CPU core |
h | Help: the full key map |
q | Quit |
Sorting is the whole interface: press P, watch the culprit rise to the top row, note its PID, and act.
One-shot and filtered invocations #
For scripts and quick checks, top also runs in batch mode:
One snapshot of the top CPU consumers
$ top -b -n 1 | head -12Watch only one user's processes
$ top -u anatop tells you that something is heavy; the PID column hands the case to kill. For a printable snapshot inside scripts, use ps. More in the journal.