How to read Linux top command output

When using Linux, the top command might be the most used command for system administrators. This provides a quick look on how your server / VPS is performing and we can quick detect many problems via reading it. However, not everybody really fully understand all output information. So I decide to write this article to guide you on how to read Linux top command output.

The first line – top

[bash]top – 04:20:08 up 22 days, 1:27, 2 users, load average: 0.00, 0.01, 0.12[/bash]

• 04:20:08 is current system time
• 22 days, 1:27 is the uptime of the node
• 2 users is the number of current user sessions
• 0.00, 0.01, 0.12 are average load on the system. The 3 values refer to the last minute, five minutes and 15 minutes
  • If your node has 4 vCPU, then the load of 2 means that each CPU core has the load of (2 / 4) = 0.5 (50%)

The 2^nd line – Tasks

[bash]Tasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie[/bash]

• 127 is the total processes running in active mode
• 1 is the number of current running process
• 126 is the number of processes in sleep mode
• 0 is the number of total stopped process
• The last 0 is the number of zombie process
  • Zombie process or defunct process is a process that has completed execution but still has an entry in the process table. This entry is still needed to allow the parent process to read its child’s exit status.

The 3^rd line – Cpu(s)

[bash]Cpu(s): 0.1%us, 0.2%sy, 0.0%ni, 99.1%id, 0.6%wa, 0.0%hi, 0.0%si, 0.1%st[/bash]

• 0.1%us is the percentage of cpu used by user processes
• 0.2%sy: percentage of cpu used by system processes
• 0.0%ni: percentage of the CPU processes with priority upgrade nice
• 99.1%id: percentage of the CPU not used
• 0.6%wa: percentage of the CPU processes waiting for I/O operations
• 0.0%hi: percentage of the CPU serving hardware interrupts (HI)
• 0.0%si: percentage of the CPU serving software interrupts (SI)
• 0.1%st: percentage of steal time
  • Steal time is the time that a virtual CPU waits for a real CPU while the hypervisor is servicing another virtual processor
  • This will be 0 on desktop and server without virtual machine

The 4^th and 5^th lines – Memory usage

[bash]Mem: 3974116k total, 3954504k used, 19612k free, 4152k buffers
Swap: 4112376k total, 2940k used, 4109436k free, 3574376k cached[/bash]

• 3974116k is total system memory (RAM)
• 3954504k is the current used memory by system
• 19612k is the free memory
• 4152k is the total memory used by buffer
• the next line is the value for swap which has the similar meaning of system memory

The mere presence of used swap is not evidence of a system which has too little RAM for its workload, the best way to determine this is to use the command vmstat if you see a lot of pages that are swapped in (si) and out (so) it means that the swap is actively used and that the system is “thrashing” or that it is needing new RAM as fast as it can swap out application data.. Generally speaking, if little swap is being used, memory usage isn’t impacting performance at all

The following rows – Processes list

[bash] PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
16200 nginx 20 0 428m 57m 44m S 2.0 1.5 0:18.52 php-fpm
19711 mysql 20 0 729m 91m 4948 S 0.7 2.3 1:16.68 mysqld
5224 nginx 20 0 46764 4064 1648 S 0.3 0.1 0:13.68 nginx
5226 nginx 20 0 46764 4016 1600 S 0.3 0.1 0:12.68 nginx [/bash]

Information for process list is as follows (with the example of the first line):

• PID: the process’ ID (16200)
• USER: the user that is the owner of the process (nginx)
• PR: priority of the process (20)
• NI: the “NICE” value of the process (0). Niceness generally ranges from -20 to 19, with -20 being the most favorable or highest priority for scheduling and 19 being the least favorable or lowest priority
• VIRT: virtual memory used by the process (428m)
• RES: physical memory used from the process (57m)
• SHR: shared memory of the process (44m)
• S: indicates the status of the process: S=sleep, R=running, Z=zombie (S)
• %CPU: the percentage of CPU used by this process (2.0)
• %MEM: the percentage of RAM used by the process (1.5)
• TIME+: the total time of activity of this process (0:18.52)
• COMMAND: the name of the process (php-fpm)

If you need to sort output based on any process information, you can use following key combinations: Press “SHIFT + F” and Select your choice below and press ENTER.

[bash]Current Sort Field: K for window 1:Def
Select sort field via field letter, type any other key to return

a: PID = Process Id x: COMMAND = Command name/line
b: PPID = Parent Process Pid y: WCHAN = Sleeping in Function
c: RUSER = Real user name z: Flags = Task Flags <sched.h>
d: UID = User Id
e: USER = User Name Note1:
f: GROUP = Group Name If a selected sort field can’t be
g: TTY = Controlling Tty shown due to screen width or your
h: PR = Priority field order, the ‘<‘ and ‘>’ keys
i: NI = Nice value will be unavailable until a field
j: P = Last used cpu (SMP) within viewable range is chosen.
* K: %CPU = CPU usage
l: TIME = CPU Time Note2:
m: TIME+ = CPU Time, hundredths Field sorting uses internal values,
n: %MEM = Memory usage (RES) not those in column display. Thus,
o: VIRT = Virtual Image (kb) the TTY & WCHAN fields will violate
p: SWAP = Swapped size (kb) strict ASCII collating sequence.
q: RES = Resident size (kb) (shame on you if WCHAN is chosen)
r: CODE = Code size (kb)
s: DATA = Data+Stack size (kb)
t: SHR = Shared Mem size (kb)
u: nFLT = Page Fault count
v: nDRT = Dirty Pages count
w: S = Process Status
[/bash]

Extra information: A good alternative to the top command is htop, an evolution of top with many excellent features. However, IMHO, the top command is really enough for common usage.