{"id":140,"date":"2014-09-04T11:06:46","date_gmt":"2014-09-04T11:06:46","guid":{"rendered":"https:\/\/devopsbuzz.com?p=140"},"modified":"2022-01-03T16:16:34","modified_gmt":"2022-01-03T16:16:34","slug":"unix-top-command","status":"publish","type":"post","link":"https:\/\/devopsbuzz.com\/unix-top-command\/","title":{"rendered":"Unix Top Command Explained (With Examples)"},"content":{"rendered":"\n

Unix top command<\/strong> helps you find out most of the system-related stuff which a Unix user needs to know about the system.<\/p>\n\n\n\n

\"top<\/a><\/figure><\/div>\n\n\n\n

Top command in Unix helps you to diagnose any system related issue and you can correct the configuration if needed based on the results.<\/p>\n\n\n\n

The top program provides a dynamic real-time view of the running system. It displays system summary information as well as a list of tasks currently being managed by the Linux kernel.<\/p>\n\n\n\n

Different System summary information is shown and all the information displayed for the tasks are user-configurable and that configuration can be saved and retained across restarts.<\/p>\n\n\n\n

In short, you can see the results of all the system related commands like \u201cfree, ps,  vmstat, who, w and uptime\u201d just by typing one command, i.e. top<\/b>.<\/p>\n\n\n\n

Type \u201ctop<\/b>\u201d command on your Unix\/Linux console and it will display all the system\u2019s information like CPU, memory, swap, running tasks<\/strong> of each process–all in a single view.<\/p>\n\n\n\n

Press \u2018q<\/strong>\u2018 to quit\/return.<\/p>\n\n\n\n

When you start top for the first time, you be presented with the traditional screen elements:<\/p>\n\n\n\n

  1. Summary Area<\/li>
  2. Message\/Prompt Line<\/li>
  3. Columns Header<\/li>
  4. Task Area<\/li><\/ol>\n\n\n\n

    To understand the top command output<\/strong>, let\u2019s go line by line.<\/p>\n\n\n\n

    \"top<\/a><\/figure><\/div>\n\n\n\n

    The first line<\/strong> shows:<\/p>\n\n\n\n

    Current System Time<\/strong> along with the information since when the system is UP and running. <\/strong><\/p>\n\n\n\n

    Number of Users <\/strong>who logged in currently to the system.<\/p>\n\n\n\n

    Load Average on the System<\/strong> at default 1, 5 and 15 minutes<\/strong> intervals.<\/p>\n\n\n\n

    The second line <\/strong>shows Process statistics<\/strong> in below format:<\/p>\n\n\n\n

    Number of Tasks <\/strong>currently assigned to the system<\/p>\n\n\n\n

    Running<\/strong>: Tasks that are currently running on the system.<\/p>\n\n\n\n

    Sleeping<\/strong>: Tasks that are not active, processes that are blocked as they are waiting for an event e.g. sleep(), time out or I\/O completion.<\/p>\n\n\n\n

    Stopped<\/strong>: It simply means that the process is “paused,” but not “terminated.” The most common source of STOP<\/code> signals is the user hitting ^z<\/code> while the process is in the foreground. A stopped process will not terminate due to a TERM<\/code> signal until it is continued. It will terminate as soon as it receives a KILL<\/code> signal even the process is stopped.<\/p>\n\n\n\n

    Zombie<\/strong>: A zombie process is a finished\/died process, it isn\u2019t all removed from memory immediately but it has still occupied an entry in the process table. Usually, a child process that has finished its execution sends a SIGCHLD signal to the parent process which has created it.<\/p>\n\n\n\n

    Then the parent process sends a wait() system call through which it can read the child\u2019s exit status. After receiving the wait system call, the child\u2019s entry will get removed from the process table.<\/p>\n\n\n\n

    But in some cases, the parent process may ignore the SIGCHLD signal which actually causes the completed process to still exist in the process table and that makes it a zombie process.<\/p>\n\n\n\n

    Sometimes this is desirable for the parent process to ensure that it doesn\u2019t allocate the same PID to another child. When a process becomes dead, it just frees up the memory and other resources allocated to it, which means a zombie process will not be using any resources at all, other than an entry in the process table.<\/p>\n\n\n\n

    However, if zombies are created at a high rate, the entire available PIDs pool will get filled with zombie processes that will prevent other processes from launching.<\/p>\n\n\n\n

    The third<\/strong> line <\/strong>shows CPU information<\/strong> in below format:<\/p>\n\n\n\n

    us<\/strong>:  Percentage (%) of  CPU time spent in user mode
    sy<\/strong>:  Percentage (%) of CPU time spent in kernel mode<\/p>\n\n\n\n

    Basically, there are two modes, user and kernel mode, %us represents the percentage of time spent on user processes, but when those processes acquire Kernel layer for some tasks such as reading or writing to the hard disk or allocating several kilobytes of RAM then it known as system calls.<\/p>\n\n\n\n

    ni<\/strong>: Percentage (%) of CPU time spent on low priority processes
    id<\/strong>: Percentage (%) of  CPU time spent idle
    wa<\/strong>: Percentage (%) of  CPU time spent in wait (on disk)
    hi<\/strong>: Percentage (%) of  CPU time spent servicing\/handling hardware interrupts (hardware irq)
    si<\/strong>: Percentage (%) of  CPU time spent servicing\/handling software interrupts (software irq)
    st<\/strong>: Percentage (%) of  CPU time in involuntary wait by virtual CPU while hypervisor is servicing another processor (or) % CPU time stolen from a virtual machine<\/p>\n\n\n\n

    hi<\/code> represents the time spent processing hardware interrupts. Hardware interrupts are generated by hardware devices when they need to send a signal to the CPU.<\/p>\n\n\n\n

    Whenever long or complex processing is required, these tasks are deferred using a mechanism call softirqs<\/code><\/strong>. These are scheduled independently, can run on any CPU, can even run concurrently. Softirqs are statically allocated at compile-time<\/p>\n\n\n\n

    si<\/code> represents the time spent in these softirqs.<\/p>\n\n\n\n

    The next two lines show memory details.<\/p>\n\n\n\n

    The fourth line <\/strong>shows Physical Memory information <\/strong>and the fifth line <\/strong><\/strong>shows Swap Memory information<\/strong><\/strong>.<\/p>\n\n\n\n

    Both lines provide you a snapshot of memory being used by various processes.<\/p>\n\n\n\n

    Mem<\/em><\/strong> represents the actual memory (RAM) that is mappable by your Unix\/Linux kernel.  It is not just used for user-related data but for kernel data as well. Kernal permanently reserves a small chunk of memory for itself to use at startup which is hidden to the user.<\/p>\n\n\n\n

    Swap<\/strong> <\/em>is used when the amount of physical memory (RAM) is full, when the RAM gets full and the system needs more memory resources, the kernel moves the inactive pages in memory to the swap space. Swap space is created on hard drives, which have a slower access time compared to physical memory.<\/p>\n\n\n\n

    Following terms are used for both Physical and Swap memories:<\/p>\n\n\n\n

    Total<\/strong>: Total Memory available in your system<\/p>\n\n\n\n

    Used<\/strong>: Memory which is being consumed by the system<\/p>\n\n\n\n

    Free<\/strong>: Free Memory for the system.<\/p>\n\n\n\n

    where Memory denotes Physical Or Swap memory respectively.<\/p>\n\n\n\n

    The below terms are a little mystifying, someone takes the wrong assumption that Cache is only for Swap memory because it’s placed inside the Swap line.<\/p>\n\n\n\n

    Actually, the simple logic for memory is:<\/p>\n\n\n\n

    Total<\/strong> = Used + Free
    Used<\/strong> = buffers+cached<\/p>\n\n\n\n

    Buffers<\/strong>: It is the size of in-memory block I\/O buffers, they relatively exist for a short span of time. When a kernel accesses the disk to access a file or block the device it increases the buffer size.<\/p>\n\n\n\n

    Cached<\/b>: Cached is the size of the Linux page cache, excluding the memory in the swap cache, which is represented by SwapCached<\/b> (hence the total page cache size is Cached + SwapCached). The cached represents the size of RAM used to cache the content of files being read recently.<\/p>\n\n\n\n

    For example, whenever you perform the read operation of a file on disk, the data gets loaded and read into memory, then it goes into the page cache.<\/p>\n\n\n\n

    Once the read operation completes, the kernel will remain with 2 options. The first is just simply throwing the page away since it is not being used and the second is to cache it for future operations.<\/p>\n\n\n\n

    So when you do another read of the same area in a file, the data will be read directly out of memory and no trip to the disk will be taken as it’s being loaded from the page cache.<\/p>\n\n\n\n

    How Cached is different from Buffers?<\/p>\n\n\n\n

    Buffers size increases when the system accesses the page whereas Cached size increase when the system accessed the page and goes back.<\/p>\n\n\n\n

    Reading a file from Cache is relatively fast compared to a fresh start.<\/p>\n\n\n\n

    Now coming to the Processes Statistics<\/strong>.<\/p>\n\n\n\n

    “top<\/strong>” provides you below details for the processes:<\/p>\n\n\n\n

    PID<\/strong>: Process ID of the process, every process has a unique process ID.<\/strong><\/p>\n\n\n\n

    USER<\/strong>: It’s a user name for the owner of each process.<\/p>\n\n\n\n

    PR<\/strong>: The priority of the task, RT denotes a Real-Time priority class that is used for system processes. PR is the actual priority of the process as viewed by the Linux kernel.<\/p>\n\n\n\n

    Kernel simply sets the priority +20 from the nice value for normal processes, which means the highest priority nice value receives a kernel priority of 0.<\/p>\n\n\n\n

    Sometimes you may see the difference in nice value and PR as the process scheduler applies a small gratuity or penalty to interactive or processor-hogging tasks as the kernel can dynamically change the user PR depending on how interactive the process is.<\/strong><\/p>\n\n\n\n

    NI: <\/strong>The nice value of the task. A negative nice value means higher priority, whereas a positive nice value means lower priority. Every new process has a nice level 0, but you can override it with the “nice” utility. NI ranges from -20 to 19.<\/p>\n\n\n\n

    VIRT:  <\/strong>VERT is the amount of virtual memory used by a process. It refers to the length of the memory area. It includes all code, data and shared libraries plus pages that have been swapped out.<\/p>\n\n\n\n

    VIRT represents how much memory the program is able to access at the present moment and it doesn’t mean that this process actually uses that amount of memory. It’s a combination of both Physical and Swap memory allocated to the process.<\/p>\n\n\n\n

    RES: <\/strong>RES is a resident size, which represents non-swapped physical memory a task is using, It tells you how many memory blocks (known as pages) are really allocated and mapped to process address space. Undoubtedly this will virtually always be less than the VIRT size.<\/p>\n\n\n\n

    SHR: <\/strong>The amount of shared memory used by a task. It simply reflects memory that could be potentially shared with other processes. SHR indicates how much of the VIRT size is actually sharable (memory or libraries).<\/p>\n\n\n\n

    The actual memory consumption of a process can be calculated RES minus SHR depending on how many shared libraries are used by any given process and other processes using those same libraries.<\/p>\n\n\n\n

    S<\/strong>: Represents Process Status<\/p>\n\n\n\n

    The status of the task can be one of:<\/p>\n\n\n\n

    ‘D’ = uninterpretable sleep
    ‘R’ = running
    ‘S’ = sleeping
    ‘T’ = traced or stopped
    ‘Z’ = zombie<\/p>\n\n\n\n

    ** Tasks shown as running should be more properly thought of as ‘ready to run’ — their task_struct is simply represented on the Linux run queue. Even without a true SMP machine, you may see numerous tasks in this state depending on the top’s delay interval and nice value.<\/p>\n\n\n\n

    %CPU<\/strong>: Represents the percentage of the timeshares CPU spends running the process. By default, top output is sorted with CPU usage.<\/p>\n\n\n\n

    %MEM<\/strong>: Represents the percentage of the physical memory of the system which is used by the process.<\/p>\n\n\n\n

    Please refer above explanations for CPU and MEM stats.<\/p>\n\n\n\n

    TIME+: <\/strong>total time CPU(s) spent running the process.<\/p>\n\n\n\n

    COMMAND<\/strong>: command used to initiate the process.<\/p>\n\n\n\n

    Unix Top Command Examples (With Shortcuts)<\/h2>\n\n\n\n

    You can use the below shortcuts to use the “top” command more efficiently<\/strong>.<\/p>\n\n\n\n

    Set \u2018Screen Refresh Interval\u2019 [delay in top output] in Top<\/span><\/h3>\n\n\n\n

    d <\/strong>or s \u2013<\/strong>To change the time interval for updating top results  (value is in sec\u2019s)<\/p>\n\n\n\n

    \"top-delay-change\"<\/a><\/figure><\/div>\n\n\n\n

    Show\/Hide lines<\/span><\/h3>\n\n\n\n

    If you don’t want to see all information, you can hide the information by using the below shortcuts:<\/p>\n\n\n\n