TOP(1)
okay bestie, this is top(1) — straight out of the General Commands Manual — and yes, we're doing the whole thing, no skimming, no skipping, because every single detail is staying. Periodt. 💅
🎀 NAME 🎀
top — display Linux processes ✨
🦋 SYNOPSIS 🦋
top [option ...]💖 DESCRIPTION 💖
So the top program is literally giving you a dynamic real-time view of a running system. It can show you system summary info and a whole list of processes or threads that the Linux kernel is currently managing. The types of system summary info it shows, plus the types, order and size of the info shown for processes — all of that is user configurable, and that config can be made persistent across restarts. Obsessed.
The program also gives you a limited interactive interface for process manipulation, plus a much more extensive interface for personal configuration — like, encompassing every aspect of how it operates. And even though we call it top all through this document, bestie, you are free to name the program anything you want. That new name (maybe an alias) will then show up on top's display and get used when reading and writing a configuration file. Main character energy fr fr. 👑
🌈 OVERVIEW 🌈
📚 Documentation 📚
Here's the rest of the Table of Contents, in all its glory:
OVERVIEW
Operation
Linux Memory Types
1. COMMAND-LINE Options
2. SUMMARY Display
a. UPTIME and LOAD Averages
b. TASK and CPU States
c. MEMORY Usage
3. FIELDS / Columns Display
a. DESCRIPTIONS of Fields
b. MANAGING Fields
4. INTERACTIVE Commands
a. GLOBAL Commands
b. SUMMARY AREA Commands
c. TASK AREA Commands
1. Appearance
2. Content
3. Size
4. Sorting
d. BOTTOM WINDOW Commands
e. COLOR Mapping
5. ALTERNATE-DISPLAY Provisions
a. WINDOWS Overview
b. COMMANDS for Windows
c. SCROLLING a Window
d. SEARCHING in a Window
e. FILTERING in a Window
6. FILES
a. PERSONAL Configuration File
b. ADDING INSPECT Entries
c. SYSTEM Configuration File
d. SYSTEM Restrictions File
7. ENVIRONMENT VARIABLE(S)
8. STUPID TRICKS Sampler
a. Kernel Magic
b. Bouncing Windows
c. The Big Bird Window
d. The Ol' Switcheroo
9. BUGS, 10. SEE Also⚙️ Operation ⚙️
When you're operating top, the two most important keys are help (h or ?) and quit (q). Or honestly, you could just use the traditional interrupt key (^C) when you're done. Whatever vibes. 🫶
First time you start it up, you'll be presented with these traditional elements on the main top screen:
- Summary Area
- Fields/Columns Header
- Task Area
Each of these gets explored in the sections that follow. There's also an Input/Message line between the Summary Area and Columns Header, which needs no further explanation. 💁
The main top screen is generally quite adaptive to changes in terminal dimensions under X-Windows. Other top screens may be less so — especially those with static text. Ultimately it depends on your particular window manager and terminal emulator, though. There may be occasions when their view of terminal size and current contents differs from top's view, which is always based on operating system calls. No cap.
Following any re-size operation, if a top screen is corrupted, or appears incomplete or disordered, simply typing something innocuous — like a punctuation character or a cursor motion key — will usually restore it. In extreme cases, this sequence almost certainly will:
key/cmd objective
^Z suspend top
fg resume top
<Left> force a screen redraw (if necessary)But if the display is still corrupted, there's one more step you could try. Insert this command after top has been suspended but before resuming it:
key/cmd objective
reset restore your terminal settingsNote: the width oftop's output will be limited to 512 positions. While not possible, displaying all fields would require approximately 580 characters. Any remaining output width is allocated to visible variable width fields. Those variable width columns, such asCOMMAND, are noted in topic 3a. DESCRIPTIONS of Fields. Actual output width may also be influenced by the-wswitch, which is discussed in topic 1. COMMAND-LINE Options. 👀
Lastly, some of top's screens or functions require the use of cursor motion keys — like the standard arrow keys plus the Home, End, PgUp and PgDn keys. If your terminal or emulator does not provide those keys, the following combinations are accepted as alternatives:
key equivalent-keys
Left alt + h
Down alt + j
Up alt + k
Right alt + l
Home alt + ctrl + h
PgDn alt + ctrl + j
PgUp alt + ctrl + k
End alt + ctrl + lThe Up and Down arrow keys have special significance when you're prompted for line input terminated with the <Enter> key. Those keys, or their aliases, can be used to retrieve previous input lines, which you can then edit and re-input. And there are four additional keys available with line oriented input:
key special-significance
Up recall older strings for re-editing
Down recall newer strings or erase entire line
Insert toggle between insert and overtype modes
Delete character removed at cursor, moving others left
Home jump to beginning of input line
End jump to end of input line🧠 Linux Memory Types 🧠
For our purposes there are three types of memory, and one of them is optional. Let's go:
- First is physical memory — a limited resource where code and data must reside when executed or referenced.
- Next is the optional swap file — where modified (dirty) memory can be saved and later retrieved if too many demands are made on physical memory.
- Lastly we have virtual memory — a nearly unlimited resource serving the following goals:
- abstraction, free from physical memory addresses/limits
- isolation, every process in a separate address space
- sharing, a single mapping can serve multiple needs
- flexibility, assign a virtual address to a file
Regardless of which of these forms memory may take, all are managed as pages (typically 4096 bytes) but expressed by default in top as KiB (kibibyte). The memory discussed under topic ‘2c. MEMORY Usage’ deals with physical memory and the swap file for the system as a whole. The memory reviewed in topic ‘3. FIELDS / Columns Display’ embraces all three memory types, but for individual processes.
For each such process, every memory page is restricted to a single quadrant from the table below. Both physical memory and virtual memory can include any of the four, while the swap file only includes #1 through #3. The memory in quadrant #4, when modified, acts as its own dedicated swap file. 🌀
Private | Shared
1 | 2
Anonymous . stack |
. malloc() |
. brk()/sbrk() | . POSIX shm*
. mmap(PRIVATE, ANON) | . mmap(SHARED, ANON)
-----------------------+----------------------
. mmap(PRIVATE, fd) | . mmap(SHARED, fd)
File-backed . pgms/shared libs |
3 | 4The following may help in interpreting process level memory values displayed as scalable columns and discussed under topic ‘3a. DESCRIPTIONS of Fields’:
%MEM - simply RES divided by total physical memory
CODE - the ‘pgms’ portion of quadrant 3
DATA - the entire quadrant 1 portion of VIRT plus all
explicit mmap file-backed pages of quadrant 3
RES - anything occupying physical memory which, beginning with
Linux-4.5, is the sum of the following three fields:
RSan - quadrant 1 pages, which include any
former quadrant 3 pages if modified
RSfd - quadrant 3 and quadrant 4 pages
RSsh - quadrant 2 pages
RSlk - subset of RES which cannot be swapped out (any quadrant)
SHR - subset of RES (excludes 1, includes all 2 & 4, some 3)
SWAP - potentially any quadrant except 4
USED - simply the sum of RES and SWAP
VIRT - everything in-use and/or reserved (all quadrants)Note: Even though program images and shared libraries are considered private to a process, they will be accounted for as shared (SHR) by the kernel. 🌸
💖 1. COMMAND-LINE Options 💖
ok so first thing first bestie, a lil note that applies to literally everything below: mandatory arguments to long options are mandatory for short options too. no skipping. 🫶
and ngl, even though nobody requires it, you can absolutely use the equals sign with either option form, and whitespace before and/or after the = is permitted. live your truth. ✨
-A,--apply-defaults— runs top with build defaults only, ignoring all configuration files except/etc/toprc. and babes, listen: this option, when specified, must be the only command line option present. periodt. 🚫-b,--batch— starts top in Batch mode, which is lowkey perfect for sending output from top to other programs or to a file. in this mode top will not accept input and runs until the iterations limit you've set with the-ncommand-line option or until killed. set it and forget it energy. 💅-c,--cmdline-toggle— starts top with the last rememberedcstate reversed. so if top was displaying command lines, now that field will show program names, and vice versa. see thecinteractive command for additional info. flip flopping is the whole vibe. 🔄-d,--delay = SECS [.TENTHS]— specifies the delay between screen updates, and overrides the corresponding value in one's personal configuration file or the startup default. later this can be changed with thedorsinteractive commands.
fractional seconds are honored, but a negative number is not allowed. and in all cases, such changes are prohibited if top is running in Secure mode, except for root (unless the s command-line option was used). for additional info on Secure mode see topic 6d. SYSTEM Restrictions File. 👑
-E,--scale-summary-mem = k | m | g | t | p | e— tells top to force summary area memory to be scaled as:k- kibibytesm- mebibytesg- gibibytest- tebibytesp- pebibytese- exbibytes
later this can be changed with the E command toggle. ✨
-e,--scale-task-mem = k | m | g | t | p— tells top to force task area memory to be scaled as:k- kibibytesm- mebibytesg- gibibytest- tebibytesp- pebibytes
later this can be changed with the e command toggle. note there's no e option here, bestie, unlike -E. read carefully. 👀
-H,--threads-show— tells top to display individual threads. without this command-line option, a summation of all threads in each process is shown. later this can be changed with theHinteractive command. 🧵-h,--help— displays usage help text, then quits. our fave kind of interaction: short and sweet. 🎀-i,--idle-toggle— starts top with the last rememberedistate reversed. when this toggle is Off, tasks that have not used any CPU since the last update will not be displayed. for additional info regarding this toggle see topic 4c. TASK AREA Commands, SIZE. 😴-n,--iterations = NUMBER— specifies the maximum number of iterations, or frames, top should produce before ending. the countdown queen. 🔢-O,--list-fields— this option acts as a form of help for the-ooption shown below. it will cause top to print each of the available field names on a separate line, then quit. such names are subject to NLS (National Language Support) translation. 🌍-o,--sort-override = FIELDNAME— specifies the name of the field on which tasks will be sorted, independent of what is reflected in the configuration file. you can prepend a+or-to the field name to also override the sort direction. a leading+will force sorting high to low, whereas a-will ensure a low to high ordering.
this option exists primarily to support automated/scripted batch mode operation. script girlies rise. 🤖
-p,--pid = PIDLIST(as:1,2,3, ...or-p1 -p2 -p3 ...) — monitor only processes with specified process IDs. however, when combined with Threads mode (H), all processes in the thread group (see TGID) of each monitored PID will also be shown.
this option can be given up to 20 times, or you can provide a comma delimited list with up to 20 pids. co-mingling both approaches is permitted. mix and match, we love a flexible queen. 🎀
a pid value of zero will be treated as the process id of the top program itself once it is running. cute.
this is a command-line option only and should you wish to return to normal operation, it is not necessary to quit and restart top -- just issue any of these interactive commands: =, u or U. no restart needed, we stay unbothered. 💅
the p, u and U command-line options are mutually exclusive. pick a lane bestie. 🚦
-S,--accum-time-toggle— starts top with the last rememberedSstate reversed. when Cumulative time mode is On, each process is listed with the cpu time that it and its dead children have used. see theSinteractive command for additional info regarding this mode. 💀 (the dead children are fine, it's a technical term, don't worry)-s,--secure-mode— starts top with secure mode forced, even for root. this mode is far better controlled through a system configuration file (see topic 6. FILES). 🔒-U,--filter-any-user = USER(as: number or name) — display only processes with a user id or user name matching that given. this option matches on any user (real, effective, saved, or filesystem).
prepending an exclamation point (!) to the user id or name instructs top to display only processes with users not matching the one provided. the classic "everyone but them" move. 🙅
the p, U and u command-line options are mutually exclusive.
-u,--filter-only-euser = USER(as: number or name) — display only processes with a user id or user name matching that given. this option matches on the effective user id only. (yeah,-uand-Uare different, look closely, this one is lowercase and pickier.)
prepending an exclamation point (!) to the user id or name instructs top to display only processes with users not matching the one provided.
the p, U and u command-line options are mutually exclusive.
-V,--version— displays version information, then quits. 🏆-w,--width [=COLUMNS]— in Batch mode, when used without an argument top will format output using theCOLUMNS=andLINES=environment variables, if set. otherwise, width will be fixed at the maximum 512 columns. with an argument, output width can be decreased or increased (up to 512) but the number of rows is considered unlimited. go off, wide queen. 📏
in normal display mode, when used without an argument top will attempt to format output using the COLUMNS= and LINES= environment variables, if set. with an argument, output width can only be decreased, not increased. whether using environment variables or an argument with -w, when not in Batch mode actual terminal dimensions can never be exceeded. the terminal always wins. sorry. 😭
Note: Without the use of this command-line option, output width is always based on the terminal at which top was invoked whether or not in Batch mode.
-1,--single-cpu-toggle— starts top with the last remembered Cpu States portion of the summary area reversed. either all cpu information will be displayed in a single line or each cpu will be displayed separately, depending on the state of the NUMA Node command toggle (2).
see the 1 and 2 interactive commands for additional info. ⭐
✨ 2. SUMMARY Display ✨
okay so listen — each of these next three areas is controlled individually, on its own, by one or more interactive commands. they don't share custody bestie 💅. and if you want the full tea on those provisions, go read topic 4b. SUMMARY AREA Commands.
🕐 2a. UPTIME and LOAD Averages
this portion is literally one single line and it's holding all of this:
- program or window name, depending on display mode
- current time and length of time since last boot
- total number of users
- system load avg over the last 1, 5 and 15 minutes
that's it. one line. main character energy. ✨
🔥 2b. TASK and CPU States
this portion is a minimum of two lines. and if you're in an SMP environment, you can get extra lines reflecting individual CPU state percentages. slay.
Line 1 shows total tasks or threads, depending on the state of the Threads-mode toggle. That total is further classified according to task state as follows:
displayed process status (‘S’)
--------- --------------------
running R
sleep S + any remaining
d-sleep D
stopped T + t
zombie ZLine 2 shows CPU state percentages based on the interval since the last refresh.
As a default, percentages for these individual categories are displayed. Depending on your kernel version, the st field may not be shown. 🙈
us : time running un-niced user processes
sy : time running kernel processes
ni : time running niced user processes
id : time spent in the kernel idle handler
wa : time waiting for I/O completion
hi : time spent servicing hardware interrupts
si : time spent servicing software interrupts
st : time stolen from this vm by the hypervisorBeyond the first tasks/threads line, there are alternate CPU display modes available via the 4-way t command toggle. They show an abbreviated summary consisting of these elements:
a b c d
%Cpu(s): 75.0/25.0 100[ ... ]Where:
- a) is the ‘user’ (us + ni) percentage;
- b) is the ‘system’ (sy + hi + si + guests) percentage;
- c) is the total percentage;
- d) is one of two visual graphs of those representations.
and those graphs? they also reflect separate ‘user’ and ‘system’ portions. obsessed. 🎀
If the 4 command toggle is used to yield more than two cpus per line, results will be further abridged, eliminating the a) and b) elements. however — that info is still reflected in the graph itself, assuming color is active or, if not, bars vs. blocks are being shown. 👑
See topic 4b. SUMMARY AREA Commands for additional information on the t and 4 command toggles.
🧠 2c. MEMORY Usage
This portion consists of two lines which may express values in kibibytes (KiB) through exbibytes (EiB) depending on the scaling factor enforced with the E interactive command. The /proc/meminfo source fields are shown in parenthesis.
Line 1 reflects physical memory, classified as:
total ( MemTotal )
free ( MemFree )
used ( MemTotal - MemAvailable )
buff/cache ( Buffers + Cached + SReclaimable )Line 2 reflects mostly virtual memory, classified as:
total ( SwapTotal )
free ( SwapFree )
used ( SwapTotal - SwapFree )
avail ( MemAvailable, which is physical memory )The avail number on line 2 is an estimation of physical memory available for starting new applications, without swapping. Unlike the free field, it attempts to account for readily reclaimable page cache and memory slabs. It is available on kernels 3.14, emulated on kernels 2.6.27+, otherwise the same as free. 💜
In the alternate memory display modes, two abbreviated summary lines are shown consisting of these elements:
a b c
GiB Mem : 18.7/15.738 [ ... ]
GiB Swap: 0.0/7.999 [ ... ]Where:
- a) is the percentage used;
- b) is the total available;
- c) is one of two visual graphs of those representations.
In the case of physical memory, the percentage represents the total minus the estimated avail noted above. The ‘Mem’ graph itself is divided between the non-cached portion of used and any remaining memory not otherwise accounted for by avail. See topic 4b. SUMMARY AREA Commands and the m command for additional information on that special 4-way toggle. 🦋
This table may help in interpreting the scaled values displayed:
KiB = kibibyte = 1024 bytes
MiB = mebibyte = 1024 KiB = 1,048,576 bytes
GiB = gibibyte = 1024 MiB = 1,073,741,824 bytes
TiB = tebibyte = 1024 GiB = 1,099,511,627,776 bytes
PiB = pebibyte = 1024 TiB = 1,125,899,906,842,624 bytes
EiB = exbibyte = 1024 PiB = 1,152,921,504,606,846,976 bytes🌈 3. FIELDS / Columns 🌈
📋 3a. DESCRIPTIONS of Fields
Listed below are top's available process fields (columns). They are shown in strict ascii alphabetical order. You may customize their position and whether or not they are displayable with the f (Fields Management) interactive command. 💖
Any field is selectable as the sort field, and you control whether they are sorted high-to-low or low-to-high. For additional information on sort provisions see topic 4c. TASK AREA Commands, SORTING.
The fields related to physical memory or virtual memory reference (KiB) which is the unsuffixed display mode. Such fields may, however, be scaled from KiB through PiB. That scaling is influenced via the e interactive command or established for startup through a build option.
%CPU — CPU Usage
The task's share of the elapsed CPU time since the last screen update, expressed as a percentage of total CPU time.
In a true SMP environment, if a process is multi-threaded and top is not operating in Threads mode, amounts greater than 100% may be reported. You toggle Threads mode with the H interactive command.
Also for multi-processor environments, if Irix mode is Off, top will operate in Solaris mode where a task's cpu usage will be divided by the total number of CPUs. You toggle Irix/Solaris modes with the I interactive command.
Note: When running in forest view mode (V) with children collapsed (v), this field will also include the CPU time of those unseen children. See topic 4c. TASK AREA Commands, CONTENT for more information regarding theVandvtoggles.
%CUC — CPU Utilization
This field is identical to %CUU below, except the percentage also reflects reaped child processes.
%CUU — CPU Utilization
A task's total CPU usage divided by its elapsed running time, expressed as a percentage.
If a process currently displays high CPU usage, this field can help determine if such behavior is normal. Conversely, if a process has low CPU usage currently, %CUU may reflect historically higher demands over its lifetime. 🔥
%MEM — Memory Usage (RES)
A task's currently resident share of available physical memory.
See ‘OVERVIEW, Linux Memory Types’ for additional details.
AGID — Autogroup Identifier
The autogroup identifier associated with a process. This feature operates in conjunction with the CFS scheduler to improve interactive desktop performance.
When /proc/sys/kernel/sched_autogroup_enabled is set, a new autogroup is created with each new session (see SID). All subsequently forked processes in that session inherit membership in this autogroup. The kernel then attempts to equalize distribution of CPU cycles across such groups. Thus, an autogroup with many CPU intensive processes (e.g make -j) will not dominate an autogroup with only one or two processes. 💅
When -1 is displayed it means this information is not available.
AGNI — Autogroup Nice Value
The autogroup nice value which affects scheduling of all processes in that group. A negative nice value means higher priority, whereas a positive nice value means lower priority.
CGNAME — Control Group Name
The name of the control group to which a process belongs, or - if not applicable for that process.
Available with cgroup v1 only, this will typically be the last entry in the full list of control groups as displayed under the CGROUPS heading. And as is true there, this field is also variable width.
CGROUPS — Control Groups
The names of the control group(s) to which a process belongs, or - if not applicable for that process.
Control Groups provide for allocating resources (cpu, memory, network bandwidth, etc.) among installation-defined groups of processes. They enable fine-grained control over allocating, denying, prioritizing, managing and monitoring those resources.
Many different hierarchies of cgroups can exist simultaneously on a system and each hierarchy is attached to one or more subsystems. A subsystem represents a single resource.
Note: The CGROUPS field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters). Even so, such variable width fields could still suffer truncation. See topic 5c. SCROLLING a Window for additional information on accessing any truncated data.
CLS — Scheduling Class
The task's current scheduling policy which can be one of:
- = not reported
TS = SCHED_OTHER
FF = SCHED_FIFO
RR = SCHED_RR
B = SCHED_BATCH
ISO = SCHED_ISO
IDL = SCHED_IDLE
DLN = SCHED_DEADLINE
? = unknown valueCODE — Code Size (KiB)
The amount of physical memory currently devoted to executable code, also known as the Text Resident Set size or TRS.
See ‘OVERVIEW, Linux Memory Types’ for additional details.
COMMAND — Command Name or Command Line
Display the command line used to start a task or the name of the associated program. You toggle between command line and name with c, which is both a command-line option and an interactive command.
When you've chosen to display command lines, processes without a command line (like kernel threads) will be shown with only the program name in brackets, as in this example:
[kthreadd]This field may also be impacted by the forest view display mode. See the V interactive command for additional information regarding that mode. 🧚
quick PSA bestie 💖 theCOMMANDfield is not fixed-width, unlike basically every other column. When it's on screen, it + every other variable-width column get handed all the leftover screen width (up to the max of512characters). And even then? Truncation can still happen, no cap. It's extra likely for this field when command lines are being displayed (that's thecinteractive command, iykyk). Wanna reach the chopped-off data anyway? Go peek at topic 5c. SCROLLING a Window. 🫶
✨ DATA — Data + Stack Size (KiB)
The amount of private memory a process has reserved. It's also known as the Data Resident Set or DRS. That memory might not be mapped to physical memory (RES) yet, but bestie, it will always be counted inside the virtual memory (VIRT) amount. periodt.
See OVERVIEW, Linux Memory Types for the extra details. 💅
🐳 Docker — Docker Container ID
The identity (that's the abbreviated hash, bestie) of the docker container a task is running inside. Not in a container? You get a dash (-). iconic.
⏳ ELAPSED — Elapsed Running Time
How long it's been since a process started. So the most recently started task shows the smallest time interval. 🦋
The value comes out as HH,MM (hours,minutes) but it's subject to extra scaling if the interval gets too big to fit the column width. At that point it scales to DD+HH (days+hours) and possibly beyond. slay, it just keeps growing.
🌱 ENVIRON — Environment variables
Displays all the environment variables, if any, exactly as seen by the respective processes. These get shown in their raw native order — not the sorted order you're used to seeing from an unqualified set. sorry babe, no alphabetizing here.
Note: theENVIRONfield, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns get allocated all remaining screen width (up to the maximum512characters). Even so, such variable width fields could still suffer truncation. This is especially true for this field. 😭 See topic 5c. SCROLLING a Window for more on accessing any truncated data.
🧚 EXE — Executable Path
Where available, this is the full path to the executable, including the program name. 💅
Note: theEXEfield, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns get allocated all remaining screen width (up to the maximum512characters).
🚩 Flags — Task Flags
This column is the task's current scheduling flags, expressed in hexadecimal notation with zeros suppressed. These flags are officially documented in <linux/sched.h>. nerd homework, go read it. 📚
👑 GID — Group Id
The effective group ID.
👯 GROUP — Group Name
The effective group name.
🎀 LOGID — Login User Id
The user ID used at login. When -1 shows up, it means this info is not available. 💀
📦 LXC — Lxc Container Name
The name of the lxc container a task is running inside. Not in a container? Dash (-). same energy as Docker, fr fr.
😇 NI — Nice Value
The nice value of the task. A negative nice value means higher priority, whereas a positive nice value means lower priority. Zero in this field simply means priority won't be adjusted when determining a task's dispatch-ability.
Note: this value only affects scheduling priority relative to other processes in the same autogroup. See theAGIDandAGNIfields for more on autogroups. 👀
🗺️ NU — Last known NUMA node
A number representing the NUMA node associated with the last used processor (P). When -1 is displayed, it means NUMA information is not available. 🙈
See the 2 and 3 interactive commands for additional NUMA provisions affecting the summary area.
💀 OOMa — Out of Memory Adjustment Factor
The value, ranging from -1000 to +1000, added to the current out of memory score (OOMs) which is then used to decide which task to kill when memory is exhausted. yes, we're talking about the murder list. 💅
🔪 OOMs — Out of Memory Score
The value, ranging from 0 to +1000, used to select task(s) to kill when memory is exhausted. Zero translates to never kill whereas 1000 means always kill. 😭 brutal but that's the deal.
🖥️ P — Last used CPU (SMP)
A number representing the last used processor. In a true SMP environment this will likely change frequently since the kernel intentionally uses weak affinity. Also — plot twist — the very act of running top may break this weak affinity and cause more processes to change CPUs more often (because of the extra demand for cpu time). we're the problem, bestie. 💀
🫂 PGRP — Process Group Id
Every process is a member of a unique process group, which is used for distribution of signals and by terminals to arbitrate requests for their input and output. When a process is created (forked), it becomes a member of the process group of its parent. By convention, this value equals the process ID (see PID) of the first member of a process group, called the process group leader. crown them. 👑
🆔 PID — Process Id
The task's unique process ID, which periodically wraps, though it never restarts at zero. In kernel terms, it's a dispatchable entity defined by a task_struct.
This value may also be used as:
- a process group ID (see
PGRP) - a session ID for the session leader (see
SID) - a thread group ID for the thread group leader (see
TGID) - and a TTY process group ID for the process group leader (see
TPGID)
one number, four jobs. multitasking queen. 💅
👪 PPID — Parent Process Id
The process ID (pid) of a task's parent.
⚡ PR — Priority
The scheduling priority of the task. If you see rt in this field, it means the task is running under real time scheduling priority. 🔥
Under linux, real time priority is somewhat misleading since traditionally the operating itself was not preemptible. And while the 2.6 kernel can be made mostly preemptible, it is not always so. lowkey complicated, ngl.
📊 PSS — Proportional Resident Memory, smaps (KiB)
The proportion of this task's share of RSS, where each page is divided by the number of processes sharing it. It's also the sum of the PSan, PSfd and PSsh fields. math girlies rise. 🧮
For example: if a process has 1000 resident pages alone and 1000 resident pages shared with another process, its PSS would be 1500 (times page size).
Accessing smaps values is 10x more costly than other memory statistics, and data for other users requires root privileges. 🫣
🌸 PSan — Proportional Anonymous Memory, smaps (KiB)
📁 PSfd — Proportional File Memory, smaps (KiB)
🧸 PSsh — Proportional Shmem Memory, smaps (KiB)
As was true for PSS above (total proportional resident memory), these fields represent the proportion of this task's share of each type of memory divided by the number of processes sharing it.
Accessing smaps values is 10x more costly than other memory statistics, and data for other users requires root privileges.
🏠 RES — Resident Memory Size (KiB)
A subset of the virtual address space (VIRT) representing the non-swapped physical memory a task is currently using. It's also the sum of the RSan, RSfd and RSsh fields.
It can include private anonymous pages, private pages mapped to files (including program images and shared libraries) plus shared anonymous pages. All such memory is backed by the swap file, represented separately under SWAP.
Lastly, this field may also include shared file-backed pages which, when modified, act as a dedicated swap file and thus will never impact SWAP.
See OVERVIEW, Linux Memory Types for additional details.
🔍 RSS — Resident Memory, smaps (KiB)
Another, more precise view of process non-swapped physical memory. It's obtained from the smaps_rollup file and is generally slightly larger than what's shown for RES.
Accessing smaps values is 10x more costly than other memory statistics, and data for other users requires root privileges.
🫧 RSan — Resident Anonymous Memory Size (KiB)
A subset of resident memory (RES) representing private pages not mapped to a file.
📚 RSfd — Resident File-Backed Memory Size (KiB)
A subset of resident memory (RES) representing the implicitly shared pages supporting program images and shared libraries. It also includes explicit file mappings, both private and shared.
🔒 RSlk — Resident Locked Memory Size (KiB)
A subset of resident memory (RES) which cannot be swapped out. locked in, literally. 🔐
🤝 RSsh — Resident Shared Memory Size (KiB)
A subset of resident memory (RES) representing the explicitly shared anonymous shm*/mmap pages.
🧍 RUID — Real User Id
The real user ID.
🪪 RUSER — Real User Name
The real user name.
🚦 S — Process Status
The status of the task, which can be one of:
D= uninterruptible sleepI= idleR= runningS= sleepingT= stopped by job control signalt= stopped by debugger during traceZ= zombie
Tasks shown as running should be more properly thought of as ready to run — their task_struct is simply represented on the Linux run-queue. Even without a true SMP machine, you may see numerous tasks in this state depending on top's delay interval and nice value. 💅
🤲 SHR — Shared Memory Size (KiB)
A subset of resident memory (RES) that may be used by other processes. It will include shared anonymous pages and shared file-backed pages. It also includes private pages mapped to files representing program images and shared libraries.
See OVERVIEW, Linux Memory Types for additional details.
🎟️ SID — Session Id
A session is a collection of process groups (see PGRP), usually established by the login shell. A newly forked process joins the session of its creator. By convention, this value equals the process ID (see PID) of the first member of the session, called the session leader, which is usually the login shell. main character of the session, fr. 👑
⏱️ STARTED — Start Time Interval
The length of time since system boot when a process started. So the most recently started task will display the largest time interval. 🦋
The value will be expressed as MM:SS (minutes:seconds). But if the interval is too great to fit the column width it will be scaled as HH,MM (hours,minutes) and possibly beyond.
💾 SUID — Saved User Id
The saved user ID. That's it, that's the whole thing, bestie. ✨
💾 SUPGIDS — Supplementary Group IDs
The IDs of any supplementary group(s) that got established at login, or inherited from a task's parent. They show up as a comma delimited list, cute little roster.
Heads up: the SUPGIDS field, unlike most columns, is not fixed-width. When it's displayed, it plus any other variable width columns get allocated all remaining screen width (up to the maximum 512 characters). So it's a little greedy. Let it eat. 💅
💾 SUPGRPS — Supplementary Group Names
The names of any supplementary group(s) established at login or inherited from a task's parent. Also a comma delimited list, also serving looks.
Same deal as above: the SUPGRPS field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters).
💾 SUSER — Saved User Name
The saved user name. Short and sweet, no notes. 🎀
💾 SWAP — Swapped Size (KiB)
The formerly resident portion of a task's address space that got written to the swap file when physical memory becomes over committed. Basically: this part of the task got evicted, lowkey rude.
See ‘OVERVIEW, Linux Memory Types’ for additional details.
💾 TGID — Thread Group Id
The ID of the thread group a task belongs to. It's the PID of the thread group leader. In kernel terms, it represents those tasks that share an mm_struct. Family tree energy. 🌈
💾 TIME — CPU Time
Total CPU time the task has used since it started. When Cumulative mode is On, each process is listed with the cpu time that it and its dead children have used. You toggle Cumulative mode with ‘S’, which is both a command-line option and an interactive command. See the ‘S’ interactive command for additional information regarding this mode. 😭 (the dead children line gets me every time)
💾 TIME+ — CPU Time, hundredths
The same as TIME, but reflecting more granularity through hundredths of a second. Same vibe, more digits. 🔥
💾 TPGID — Tty Process Group Id
The process group ID of the foreground process for the connected tty, or -1 if a process is not connected to a terminal. By convention, this value equals the process ID (see PID) of the process group leader (see PGRP).
💾 TTY — Controlling Tty
The name of the controlling terminal. This is usually the device (serial port, pty, etc.) from which the process was started, and which it uses for input or output. However, a task need not be associated with a terminal — in which case you'll see ‘?’ displayed. The mystery box of columns. 🙈
💾 UID — User Id
The effective user ID of the task's owner.
💾 USED — Memory in Use (KiB)
This field represents the non-swapped physical memory a task is using (RES) plus the swapped out portion of its address space (SWAP). It's a combo, a collab, a duo. 🫶
See ‘OVERVIEW, Linux Memory Types’ for additional details.
💾 USER — User Name
The effective user name of the task's owner.
💾 USS — Unique Set Size
The non-swapped portion of physical memory (‘RSS’) not shared with any other process. It is derived from the ‘smaps_rollup’ file.
Real talk: accessing smaps values is 10x more costly than other memory statistics, and data for other users requires root privileges. So it's giving expensive. 💀
💾 VIRT — Virtual Memory Size (KiB)
The total amount of virtual memory used by the task. It includes all code, data and shared libraries plus pages that have been swapped out and pages that have been mapped but not used.
See ‘OVERVIEW, Linux Memory Types’ for additional details.
💾 WCHAN — Sleeping in Function
This field shows the name of the kernel function in which the task is currently sleeping. Running tasks will display a dash (‘-’) in this column. Napping in a named function, iconic behavior. 😴
💾 ioR — I/O Bytes Read
The number of bytes a process caused to be fetched from the storage layer.
Root privileges are required to display ‘io’ data for other users. 🔒
💾 ioRop — I/O Read Operations
The number of read I/O operations (syscalls) for a process. Such calls might not result in actual physical disk I/O. (Cached, bestie. Cached.)
💾 ioW — I/O Bytes Written
The number of bytes a process caused to be sent to the storage layer.
💾 ioWop — I/O Write Operations
The number of write I/O operations (syscalls) for a process. Such calls might not result in actual physical disk I/O.
💾 nDRT — Dirty Pages Count
The number of pages that have been modified since they were last written to auxiliary storage. Dirty pages must be written to auxiliary storage before the corresponding physical memory location can be used for some other virtual page.
This field was deprecated with linux 2.6 and is always zero. It's a ghost. It's still here. It contributes nothing. We respect it anyway. 👑
💾 nFD — Number of File Descriptors
The total number of open files associated with a process.
💾 nMaj — Major Page Fault Count
The number of major page faults that have occurred for a task. A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space. A major page fault is when auxiliary storage access is involved in making that page available.
💾 nMin — Minor Page Fault count
The number of minor page faults that have occurred for a task. A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space. A minor page fault does not involve auxiliary storage access in making that page available.
💾 nTH — Number of Threads
The number of threads associated with a process. Squads. 🧚
💾 nsCGROUP — CGROUP namespace
The Inode of the namespace used to hide the identity of the control group of which process is a member.
💾 nsIPC — IPC namespace
The Inode of the namespace used to isolate interprocess communication (IPC) resources such as System V IPC objects and POSIX message queues.
💾 nsMNT — MNT namespace
The Inode of the namespace used to isolate filesystem mount points, thus offering different views of the filesystem hierarchy.
💾 nsNET — NET namespace
The Inode of the namespace used to isolate resources such as network devices, IP addresses, IP routing, port numbers, etc.
💾 nsPID — PID namespace
The Inode of the namespace used to isolate process ID numbers, meaning they need not remain unique. Thus, each such namespace could have its own ‘init/systemd’ (PID #1) to manage various initialization tasks and reap orphaned child processes.
💾 nsTIME — TIME namespace
The Inode of the namespace which allows processes to see different system times in a way similar to the UTS namespace.
💾 nsUSER — USER namespace
The Inode of the namespace used to isolate the user and group ID numbers. Thus, a process could have a normal unprivileged user ID outside a user namespace while having a user ID of 0, with full root privileges, inside that namespace. Main character in one namespace, NPC in another. 💅
💾 nsUTS — UTS namespace
The Inode of the namespace used to isolate hostname and NIS domain name. UTS simply means "Unix Time-sharing System".
💾 vMj — Major Page Fault Count Delta
The number of major page faults that have occurred since the last update (see nMaj).
💾 vMn — Minor Page Fault Count Delta
The number of minor page faults that have occurred since the last update (see nMin).
🛠️ 3b. MANAGING Fields
After pressing the interactive command ‘f’ (Fields Management) you will be presented with a screen showing: 1) the ‘current’ window name; 2) the designated sort field; 3) all fields in their current order along with descriptions. Entries marked with an asterisk are the currently displayed fields, screen width permitting. Asterisk = on display. Slay. ⭐
- As the on screen instructions indicate, you navigate among the fields with the Up and Down arrow keys. The PgUp, PgDn, Home and End keys can also be used to quickly reach the first or last available field.
- The Right arrow key selects a field for repositioning and the Left arrow key or the <Enter> key commits that field's placement.
- The ‘
d’ key or the <Space> bar toggles a field's display status, and thus the presence or absence of the asterisk. - The ‘
s’ key designates a field as the sort field. See topic 4c. TASK AREA Commands, SORTING for additional information regarding your selection of a sort field. - The ‘
a’ and ‘w’ keys can be used to cycle through all available windows and the ‘q’ or <Esc> keys exit Fields Management.
The Fields Management screen can also be used to change the ‘current’ window/field group in either full-screen mode or alternate-display mode. Whatever was targeted when ‘q’ or <Esc> was pressed will be made current as you return to the top display. See topic 5. ALTERNATE-DISPLAY Provisions and the ‘g’ interactive command for insight into ‘current’ windows and field groups.
Note: Any window that has been scrolled horizontally will be reset if any field changes are made via the Fields Management screen. Any vertical scrolled position, however, will not be affected. See topic 5c. SCROLLING a Window for additional information regarding vertical and horizontal scrolling.
🎮 4. INTERACTIVE Commands
Listed below is a brief index of commands within categories. Some commands appear more than once — their meaning or scope may vary depending on the context in which they are issued. (Context-sensitive queens. We love to see it. 👑)
4a. Global-Commands
<Ent/Sp> ?, =, 0,
A, B, d, E, e, g, H, h, I, k, q, r, s, W, X, Y, Z,
^E, ^R
4b. Summary-Area-Commands
C, l, t, m, 1, 2, 3, 4, 5, !, ^
4c. Task-Area-Commands
Appearance: b, J, j, x, y, z
Content: c, F, f, O, o, S, U, u, V, v
Size: #, i, n
Sorting: <, >, f, R
4d. Bottom-Window-Commands
^A, ^G, ^K, ^L, ^N, ^P, ^U, Tab, Shift+Tab
4e. Color-Mapping
<Ret>, a, B, b, H, M, q, S, T, w, z, @, 0 - 7
5b. Commands-for-Windows
-, _, =, +, A, a, G, g, w
5c. Scrolling-a-Window
C, Up, Dn, Left, Right, PgUp, PgDn, Home, End
5d. Searching-in-a-Window
L, &
5e. Filtering-in-a-Window
O, o, ^O, =, +🌍 4a. GLOBAL Commands
The global interactive commands are always available in both full-screen mode and alternate-display mode. However, some of these interactive commands are not available when running in Secure mode. 🚫
If you wish to know in advance whether or not your top has been secured, simply ask for help and view the system summary on the second line. The second line knows. The second line always knows. ✨
<Enter>or<Space>— :Refresh-Display. These two wake top up 💖 — the second you send any input, the whole entire display gets repainted. They also force an update for any hotplugged cpu or physical memory changes, so if you just plugged something in, hit one of these. If you've got a huge delay interval going and you're dying to see the current status, use either of these keys, fr fr.?|h— :Help. There are two help levels available bestie. The first one gives you a lil reminder of all the basic interactive commands. If top is secured, that screen gets abbreviated. Typinghor?on the primary help screen takes you to help for specialize keys — see topic 4d. BOTTOM WINDOW Commands for extra deets. TypingHon the primary help screen takes you to help for those interactive commands applicable to alternate-display mode — see topic 5. ALTERNATE-DISPLAY Provisions for more. 👑=— :Exit-Display-Limits. Removes restrictions on what's shown 🦋. This command reverses anyi(idle tasks),n(max tasks),v(hide children) andFfocus commands that might be active. It also provides for an exit from PID monitoring, User filtering, Other filtering, Locate processing and Combine Cpus mode. And bonus: if the window has been scrolled, it gets reset with this command too.0— :Zero-Suppress toggle. This command decides whether zeros are shown or suppressed for many of the fields in a task window. Fields likeUID,GID,NI,PRorPare not affected by this toggle, just so you know.A— :Alternate-Display-Mode toggle. Switches between full-screen mode and alternate-display mode ✨. See topic 5. ALTERNATE-DISPLAY Provisions and theginteractive command for the tea on 'current' windows and field groups.B— :Bold-Disable/Enable toggle. This one influences use of the bold terminfo capability and alters both the summary area and task area for the 'current' window. It's intended primarily for use with dumb terminals, but honestly you can apply it anytime.
Note: When this toggle is On and top is operating in monochrome mode, the entire display will appear as normal text. So unless thexand/orytoggles are using reverse for emphasis, there will be no visual confirmation that they are even on. 🙈
*d|s— :Change-Delay-Time-interval. You'll be prompted to enter the delay time, in seconds, between display updates.
Fractional seconds are honored, but a negative number is not allowed, periodt. Entering 0 causes (nearly) continuous updates, with an unsatisfactory display as the system and tty driver try to keep up with top's demands. The delay value is inversely proportional to system loading, so set it with care bestie.
If at any time you wish to know the current delay time, simply ask for help and view the system summary on the second line.
E— :Enforce-Summary-Memory-Scale in Summary Area. With this command you can cycle through the available summary area memory scaling, which ranges fromKiB(kibibytes or1,024bytes) throughEiB(exbibytes or1,152,921,504,606,846,976bytes) 💫.
If you see a + between a displayed number and the following label, it means top was forced to truncate some portion of that number. By raising the scaling factor, such truncation can be avoided.
e— :Enforce-Task-Memory-Scale in Task Area. Cycle through the available task area memory scaling, ranging fromKiB(kibibytes or1,024bytes) throughPiB(pebibytes or1,125,899,906,842,624bytes) 🌸.
While top will try to honor the selected target range, additional scaling might still be necessary in order to accommodate current values. If you wish to see a more homogeneous result in the memory columns, raising the scaling range will usually accomplish that goal. Raising it too high, however, is likely to produce an all zero result which cannot be suppressed with the 0 interactive command. 💀
g— :Choose-Another-Window/Field-Group. You'll be prompted to enter a number between1and4designating the field group which should be made the 'current' window. You'll soon grow comfortable with these 4 windows, especially after experimenting with alternate-display mode 🎀.H— :Threads-mode toggle. When this toggle is On, individual threads will be displayed for all processes in all visible task windows. Otherwise, top displays a summation of all threads in each process.I— :Irix/Solaris-Mode toggle. When operating in Solaris mode (Itoggled Off), a task's cpu usage will be divided by the total number of CPUs. After issuing this command, you'll be told the new state of this toggle.*k— :Kill-a-task. You'll be prompted for a PID and then the signal to send 🔥.
Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself.
The default signal, as reflected in the prompt, is SIGTERM. However, you can send any signal, via number or name.
If you wish to abort the kill process, do one of the following depending on your progress:
- at the pid prompt, type an invalid number
- at the signal prompt, type
0(or any invalid signal) - at any prompt, type
<Esc>
q— :Quit*r— :Renice-a-Task. You'll be prompted for a PID and then the value to nice it to.
Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself.
A positive nice value will cause a process to lose priority. Conversely, a negative nice value will cause a process to be viewed more favorably by the kernel. As a general rule, ordinary users can only increase the nice value and are prevented from lowering it.
If you wish to abort the renice process, do one of the following depending on your progress:
- at the pid prompt, type an invalid number
- at the nice prompt, type
<Enter>with no input - at any prompt, type
<Esc>
W— :Write-the-Configuration-File. This will save all of your options and toggles plus the current display mode and delay time 💾. By issuing this command just before quitting top, you'll be able to restart later in exactly that same state. Iconic behaviour honestly.X— :Extra-Fixed-Width. Some fields are fixed width and not scalable. As such, they are subject to truncation, which would be indicated by a+in the last position.
This interactive command can be used to alter the widths of the following fields:
field default field default field default
GID 5 Docker 8 WCHAN 10
LOGID 5 GROUP 8 nsCGROUP 10
RUID 5 LXC 8 nsIPC 10
SUID 5 RUSER 8 nsMNT 10
UID 5 SUSER 8 nsNET 10
TTY 8 nsPID 10
USER 8 nsTIME 10
nsUSER 10
nsUTS 10You'll be prompted for the amount to be added to the default widths shown above. Entering zero forces a return to those defaults.
If you enter a negative number, top will automatically increase the column size as needed until there is no more truncated data. 🪄
Note: Whether explicitly or automatically increased, the widths for these fields are never decreased by top. To narrow them you must specify a smaller number or restore the defaults.
Y— :Inspect-Other-Output. After issuing theYinteractive command, you'll be prompted for a target PID. Typing a value or accepting the default results in a separate screen. That screen can be used to view a variety of files or piped command output while the normal top iterative display is paused 👀.
Note: This interactive command is only fully realized when supporting entries have been manually added to the end of the top configuration file. For details on creating those entries, see topic 6b. ADDING INSPECT Entries.
Most of the keys used to navigate the Inspect feature are reflected in its header prologue. There are, however, additional keys available once you have selected a particular file or command. They are familiar to anyone who has used the pager less and are summarized here for future reference.
key function
= alternate status-line, file or pipeline
/ find, equivalent to 'L' locate
n find next, equivalent to '&' locate next
<Space> scroll down, equivalent to <PgDn>
b scroll up, equivalent to <PgUp>
g first line, equivalent to <Home>
G last line, equivalent to <End>Z— :Change-Color-Mapping. This key takes you to a separate screen where you can change the colors for the 'current' window, or for all windows 🌈. For details regarding this interactive command see topic 4e. COLOR Mapping.^E— :Scale-CPU-Time-fields (Ctrl key +e). The 'time' fields are normally displayed with the greatest precision their widths permit. This toggle reduces that precision until it wraps. It also illustrates the scaling those fields might experience automatically, which usually depends on how long the system runs.
For example, if MMM:SS.hh is shown, each ^E keystroke would change it to: MM:SS, Hours,MM, Days+Hours and finally Weeks+Days.
Not all time fields are subject to the full range of such scaling.
^R— :Renice-an-Autogroup (that's Ctrl key +r, bestie 💅)
It's gonna ask you for a PID, and then for the value of its autogroup AGNI.
Type in no PID at all and it just takes the default that's sitting right there in the prompt (which is the first task displayed). Vibes.
A positive AGNI value makes the processes in that autogroup lose priority. And conversely — a negative value means the kernel looks at them more favorably 🥰. But heads up: ordinary users are not allowed to set negative AGNI values. Sorry babe, that's a root thing.
Wanna bail on the whole renice thing? Hit <Esc>. Escape hatch, literally. 🙈
- The commands shown with an asterisk (
*) are not available in Secure mode, nor will they be shown on the level-1 help screen.
4b. SUMMARY AREA Commands ✨
The summary area interactive commands are always available in both full-screen mode and alternate-display mode. They mess with the beginning lines of your display, and they decide where your messages and prompts end up. So like, lowkey important. 👑
These commands always impact just the 'current' window / field group. Want the full tea on what "current" even means? See topic 5. ALTERNATE-DISPLAY Provisions and the g interactive command. iykyk.
C— :Show-scroll-coordinates toggle
Toggles an informational message that shows up whenever the message line isn't otherwise busy. For more deets, go look at topic 5c. SCROLLING a Window.
l— :Load-Average/Uptime toggle
This is also the line that holds the program name (possibly an alias, no judgment) when you're in full-screen mode, or the 'current' window name when you're in alternate-display mode.
t— :Task/Cpu-States toggle
This command affects anywhere from 2 to many summary area lines, depending on the state of the 1, 2 or 3 command toggles and whether or not top is running under true SMP.
This part of the summary area is also influenced by the H interactive command toggle — you'll see it reflected in the total label, which shows either Tasks or Threads.
It's a 4-way toggle, cycling through these modes:
- detailed percentages by category
- abbreviated user/system and total % + bar graph
- abbreviated user/system and total % + block graph
- turn off task and cpu states display
When you're in either of the graphic modes, the display gets so much more meaningful when individual CPUs or NUMA nodes are also shown. See the 1, 2 and 3 commands below for more. 🫶
m— :Memory/Swap-Usage toggle
This one affects the two summary area lines dealing with physical and virtual memory.
Also a 4-way toggle, cycling through these modes:
- detailed percentages by memory type
- abbreviated % used/total available + bar graph
- abbreviated % used/total available + block graph
- turn off memory display
1— :Single/Separate-Cpu-States toggle
This command affects how the t command's Cpu States portion is shown. Even though this toggle basically exists to serve massively-parallel SMP machines, it is not restricted to solely SMP environments. She's for everyone 💖
When you see %Cpu(s): in the summary area, the 1 toggle is On and all cpu info is gathered into a single line. Otherwise, each cpu gets displayed separately as: %Cpu0, %Cpu1, ... — up to the available screen height.
2— :NUMA-Nodes/Cpu-Summary toggle
Toggles between the 1 command cpu summary display (only) or a summary display plus the cpu usage statistics for each NUMA Node. It's only available if a system has the requisite NUMA support.
3— :Expand-NUMA-Node
You'll be invited to enter a number representing a NUMA Node. After that, a node summary plus the statistics for each cpu in that node gets shown — until the 1, 2 or 4 command toggle is pressed. This interactive command is only available if a system has the requisite NUMA support.
4— :Display-Multiple-Elements-Adjacent toggle
This toggle turns the 1 toggle Off and shows multiple CPU and Memory results on each line. Every successive 4 key adds another CPU, until it eventually reverts back to separate lines for CPU and Memory results.
A maximum of 8 CPUs per line can be displayed this way. That said, data truncation may occur before you even reach the maximum. That is definitely true when displaying detailed statistics via the t command toggle, since that kind of data can't be scaled like the graphic representations. 💀
Wanna bounce out of adjacent mode fast without cycling all the way to 8? Just use the 1 command toggle. easy.
5— :Display-P-Cores-and-E-Cores toggle
This command toggle is only active when a platform has multiple cores of two distinct types: multi-threaded (P-Core) and single-threaded (E-Core).
Normally each cpu is displayed as %Cpu0, %Cpu1, ..., but this toggle lets you identify and/or filter those cpus by their core type — either P-Core (performance) or E-Core (efficient).
The 1st time 5 is struck, each CPU shows as %CpP or %CpE, representing the two core types. The 2nd time, only P-Cores (%CpP) will be shown. The 3rd time, only E-Cores (%CpE) are displayed. And when you strike this toggle for the 4th time, the CPU display returns to the normal %Cpu convention. Slay, we're back. 🦋
!— :Combine-Cpus-Mode toggle
This one is intended for massively parallel SMP environments where, even with the 4 command toggle, not all processors can be displayed. Every press of ! doubles the number of cpus combined, which cuts down the total number of cpu lines displayed.
For example, with the first press of ! two cpus will be combined and displayed as 0-1, 2-3, ... instead of the normal %Cpu0, %Cpu1, %Cpu2, %Cpu3, .... With a second ! command toggle, four cpus are combined and shown as 0-3, 4-7, .... Then on the third ! press, combining eight cpus, it shows as 0-7, 8-15, ..., etc.
That progression keeps going until individual cpus are displayed again. Use the = command to exit Combine Cpus mode. 🧚
^— :Show-Cores-vs-Cpus toggle
Modern platforms typically implement some form of Simultaneous Multithreading (SMT), which lets multiple threads execute simultaneously on a single physical core. Two threads per core is the most common. That said, some enterprise and specialized architectures support higher thread counts. 👑
This command toggle is used to display the utilization of physical cpu cores rather than individually reported cpus or threads.
Note: If the entire summary area has been toggled Off for any window, you'd be left with just the message line. That way, you've maximized available task rows but (temporarily) sacrificed the program name in full-screen mode — or the 'current' window name when you're in alternate-display mode. sacrifices were made. 😭
4c. TASK AREA Commands 🌸
The task area interactive commands are always available in full-screen mode.
The task area interactive commands are never available in alternate-display mode if the 'current' window's task display has been toggled Off (see topic 5. ALTERNATE-DISPLAY Provisions).
APPEARANCE of task window 💅
J— :Justify-Numeric-Columns toggle
Alternates between right-justified (the default) and left-justified numeric data. If the numeric data completely fills the available column, this command toggle may impact the column header only.
j— :Justify-Character-Columns toggle
Alternates between left-justified (the default) and right-justified character data. If the character data completely fills the available column, this command toggle may impact the column header only.
The following commands will also be influenced by the state of the global B (bold enable) toggle. 👀
b— :Bold/Reverse toggle
This command impacts how the x and y toggles are displayed. It may also impact the summary area when a bar graph has been selected for cpu states or memory usage via the t or m toggles.
x— :Column-Highlight toggle
Changes the highlighting for the current sort field. If you forget which field is being sorted, this command is a quick lil visual reminder — providing the sort field is actually being displayed. The sort field might not be visible because:
- there is insufficient Screen Width
- the
finteractive command turned it Off
y— :Row-Highlight toggle
Changes highlighting for "running" tasks. For additional insight into this task state, see topic 3a. DESCRIPTIONS of Fields, the S field (Process Status).
Using this provision gives you important insight into your system's health. The only costs will be a few additional tty escape sequences. worth it fr fr 💖
z— :Color/Monochrome toggle
Switches the 'current' window between your last used color scheme and the older form of black-on-white or white-on-black. This command alters both the summary area and task area, but it does not affect the state of the x, y or b toggles.
CONTENT of task window 🍓
c— :Command-Line/Program-Name toggle
This command will be honored whether or not the COMMAND column is currently visible. Later, should that field come into view, the change you applied will be seen. it was patient, bestie.
F— :Maintain-Parent-Focus toggle
When you're in forest view mode, this key serves as a toggle to retain focus on a target task — presumably one with forked children. If forest view mode is Off, this key has no effect. nothing. zero. nada.
The toggle is applied to the first (topmost) process in the 'current' window. Once established, that task is always displayed as the first (topmost) process, along with its forked children. All other processes will be suppressed. 🙈
Note: keys likei(idle tasks),n(max tasks),v(hide children) and User/Other filtering remain accessible and can impact what is displayed. 💅
f:Fields-Management — this key pops open a whole separate screen where you can change which fields are displayed, their order, and also designate the sort field. For the full tea on this interactive command, see topic 3b. MANAGING Fields. ✨O|o:Other-Filtering — you'll get prompted for the selection criteria, and that's what determines which tasks get shown in thecurrentwindow. Your criteria can be made case sensitive or case can be ignored. And you decide if top should include or exclude matching tasks. 🫶
See topic 5e. FILTERING in a window for the details on these plus other related interactive commands.
S:Cumulative-Time-Mode toggle — when Cumulative mode is On, each process is listed with the cpu time that it and its dead children have used. 💀
When Off, programs that fork into many separate tasks will appear less demanding. For programs like init or a shell this is appropriate, but for others, like compilers, perhaps not. Literally go experiment with two task windows sharing the same sort field but with different S states and see which representation you prefer. 👑
After you issue this command, you'll be informed of the new state of this toggle. If you wish to know in advance whether or not Cumulative mode is in effect, simply ask for help and view the window summary on the second line. 🔍
U|u:Show-Specific-User-Only — you'll be prompted for the uid or name of the user to display. The-uoption matches on effective user whereas the-Uoption matches on any user (real, effective, saved, or filesystem). 🧚
Thereafter, in that task window only matching users will be shown, or possibly no processes will be shown. Prepending an exclamation point (!) to the user id or name instructs top to display only processes with users not matching the one provided. 🙈
Different task windows can be used to filter different users. Later, if you wish to monitor all users again in the current window, re-issue this command but just press <Enter> at the prompt. 💖
V:Forest-View-Mode toggle — in this mode, processes are reordered according to their parents and the layout of theCOMMANDcolumn resembles that of a tree. 🌳 In forest view mode it's still possible to toggle between program name and command line (see thecinteractive command) or between processes and threads (see theHinteractive command).
Note: typing any key affecting the sort order will exit forest view mode in the current window. See topic 4c. TASK AREA Commands, SORTING for info on those keys.
v:Hide/Show-Children toggle — when in forest view mode, this key serves as a toggle to collapse or expand the children of a parent. 🌸
The toggle is applied against the first (topmost) process in the current window. See topic 5c. SCROLLING a Window for additional info regarding vertical scrolling.
If the target process has not forked any children, this key has no effect. It also has no effect when not in forest view mode. 💀
✨ SIZE of task window ✨
i:Idle-Process toggle — displays all tasks or just active tasks. When this toggle is Off, tasks that have not used any CPU since the last update will not be displayed. However, due to the granularity of the%CPUandTIME+fields, some processes may still be displayed that appear to have used no CPU. 😭
If this command is applied to the last task display when in alternate-display mode, then it will not affect the window's size, as all prior task displays will have already been painted. 🎨
n|#:Set-Maximum-Tasks — you'll be prompted to enter the number of tasks to display. The lessor of your number and available screen rows will be used. 🔢
When used in alternate-display mode, this is the command that gives you precise control over the size of each currently visible task display, except for the very last. It will not affect the last window's size, as all prior task displays will have already been painted.
Note: if you wish to increase the size of the last visible task display when in alternate-display mode, simply decrease the size of the task display(s) above it. galaxy brain 🧠✨
✨ SORTING of task window ✨
For compatibility, this top supports most of the former top sort keys. Since this is primarily a service to former top users, these commands do not appear on any help screen. 👀
command sorted-field supported
A start time (non-display) No
M %MEM Yes
N PID Yes
P %CPU Yes
T TIME+ YesBefore using any of the following sort provisions, top suggests that you temporarily turn on column highlighting using the x interactive command. That will help ensure that the actual sort environment matches your intent. 💡
The following interactive commands will only be honored when the current sort field is visible. The sort field might not be visible because:
- there is insufficient Screen Width
- the
finteractive command turned it Off
<— :Move-Sort-Field-Left — moves the sort column to the left unless the current sort field is the first field being displayed. ⬅️>— :Move-Sort-Field-Right — moves the sort column to the right unless the current sort field is the last field being displayed. ➡️
The following interactive commands will always be honored whether or not the current sort field is visible. 💯
f:Fields-Management — this key displays a separate screen where you can change which field is used as the sort column, among other functions. This can be a convenient way to simply verify the current sort field, when running top with column highlighting turned Off. ✅R:Reverse/Normal-Sort-Field toggle — using this interactive command you can alternate between high-to-low and low-to-high sorts. 🔄
🌈 4d. BOTTOM WINDOW Commands 🌈
These keys invoke a separate window at the bottom of the screen while normal top monitoring continues uninterrupted. Keying the same Ctrl command a second time removes that separate window — as does the = command. 🪄
The following are applied to the 1st task displayed. The Up/Down arrow keys will be important in choosing a target process, as is a more stable display like forest view or a sort on PID or a larger delay interval.
^A— :Display-Capabilities (Ctrlkey +a)^G— :Display-Control-Groups (Ctrlkey +g)^K— :Display-Cmdline (Ctrlkey +k)^N— :Display-Environment (Ctrlkey +n)^P— :Display-Namespaces (Ctrlkey +p)^U— :Display-Supplementary-Groups (Ctrlkey +u)
This command is not associated with a specific task. Rather, up to 10 of the most recent messages issued by top are recalled for review. 📜
^L— :Display-Logged-Messages (Ctrlkey +l)
The Tab key (forward) or Shift+Tab combination (backward) can be used to highlight individual elements being displayed in the bottom window. 🎯
Notable among these provisions is the Ctrl+N (environment) command. Its output can be extensive and not easily read when line wrapped. A more readable version can be achieved with an Inspect entry in the rcfile like the following. 💖
pipe ^I Environment ^I cat /proc/%d/environ | tr '\0' '\n'See the Y interactive command under 4a. GLOBAL Commands and topic 6b. ADDING INSPECT Entries for additional information.
🎀 4e. COLOR Mapping 🎀
When you issue the Z interactive command, you will be presented with a separate screen. That screen can be used to change the colors in just the current window or in all four windows before returning to the top display. 🌈
The following interactive commands are available.
5upper case letters to select a target8numbers to select a color (@selects no color)- normal toggles available
B:bold disable/enableb:running tasks "bold"/reversez:color/mono
- other commands available
a/w:apply, then go to next/prior<Enter>:apply and exitq:abandon current changes and exit
If you use a or w to cycle the targeted window, you will have applied the color scheme that was displayed when you left that window. You can, of course, easily return to any window and reapply different colors or turn colors Off completely with the z toggle. 🎨
The Color Mapping screen can also be used to change the current window/field group in either full-screen mode or alternate-display mode. Whatever was targeted when q or <Enter> was pressed will be made current as you return to the top display. 👑
✨ 5. ALTERNATE-DISPLAY Provisions ✨
🌸 5a. WINDOWS Overview 🌸
Field Groups/Windows:
In full-screen mode there is a single window represented by the entire screen. That single window can still be changed to display 1 of 4 different field groups (see the g interactive command, repeated below). Each of the 4 field groups has a unique separately configurable summary area and its own configurable task area. 🫶
In alternate-display mode, those 4 underlying field groups can now be made visible simultaneously, or can be turned Off individually at your command. 💅
The summary area will always exist, even if it's only the message line. At any given time only one summary area can be displayed. However, depending on your commands, there could be from zero to four separate task displays currently showing on the screen. 🌈
Current Window:
The current window is the window associated with the summary area and the window to which task related commands are always directed. Since in alternate-display mode you can toggle the task display Off, some commands might be restricted for the current window. ⚠️
A further complication arises when you've toggled that first summary area line Off. Once the window name is gone (that's the 'l'-toggled line, bestie 😭), you're lowkey flying blind on which window is even the 'current' one. Not ideal!
5b. COMMANDS for Windows
-|_:Show/Hide-Window(s) toggles The'-'key flips the'current'window's task display On and Off. When it's On, that task area will show a minimum of the columns header you established with the'f'interactive command. It'll also reflect any other task area options/toggles you've applied, yielding zero or more tasks. The'_'key does the exact same thing but for all task displays. In other words, it switches between the currently visible task display(s) and any task display(s) you had toggled Off. And if all 4 task displays are currently visible? This interactive command leaves the summary area as the only display element. Boom, minimalist era. ✨=|+:Equalize/Reset-Window(s) The'='key forces the'current'window's task display to be visible. It also reverses any active'i'(idle tasks),'n'(max tasks),'u/U'(user filter),'o/O'(other filter),'v'(hide children),'F'focused,'L'(locate) and'!'(combine cpus) commands. Also, if the window had been scrolled, this command resets it. See topic 5c. SCROLLING a Window for more on vertical and horizontal scrolling, iykyk. The'+'key does the same for all windows. The four task displays will reappear, evenly balanced, while retaining any customizations previously applied beyond those noted for the'='command toggle. 🎀A:Alternate-Display-Mode toggle This command switches between full-screen mode and alternate-display mode. The first time you issue this command, all four task displays will be shown. After that, every time you switch modes, you'll see only the task display(s) you've chosen to make visible. It's giving curated. 💅a|w:Next-Window-Forward/Backward This changes the'current'window, which in turn changes the window that commands get directed to. These keys act in a circular fashion, so you can reach any desired window using either key. 🦋 Assuming the window name is visible (you haven't toggled'l'Off), whenever the'current'window name loses its emphasis/color, that's your lil reminder that the task display is Off and many commands will be restricted. Consider it a vibe check. 👑G:Change-Window/Field-Group-Name You'll be prompted for a new name to apply to the'current'window. It does not require that the window name be visible (the'l'toggle to be On).- ✨ The interactive commands shown with an asterisk (
'*') have use beyond alternate-display mode.=,A,gare always availablea,wact the same with color mapping and fields management
g:Choose-Another-Window/Field-Group You'll be prompted to enter a number between 1 and 4, designating the field group that should become the'current'window. In full-screen mode, this command is necessary to alter the'current'window. In alternate-display mode, it's simply a less convenient alternative to the'a'and'w'commands. No shade, just facts. 🌸
5c. SCROLLING a Window
Typically a task window is just a partial view into a system's total tasks/threads, showing only some of the available fields/columns. With these scrolling keys, you can move that view vertically or horizontally to reveal any desired task or column. Main character energy for your cursor. ✨
Up,PgUp:Scroll-Tasks Move the view up toward the first task row, until the first task is displayed at the top of the'current'window. The Up arrow key moves a single line whilePgUpscrolls the entire window.Down,PgDn:Scroll-Tasks Move the view down toward the last task row, until the last task is the only task displayed at the top of the'current'window. The Down arrow key moves a single line whilePgDnscrolls the entire window.Left,Right:Scroll-Columns Move the view of displayable fields horizontally one column at a time.
Note: just a reminder, some fields/columns are not fixed-width but get allocated all remaining screen width when visible. So when you scroll right or left, that feature may produce some unexpected results at first. Don't panic, it's not you, it's the layout. 😭
Additionally, there are special provisions for any variable width field when it's positioned as the last displayed field. Once you reach that field via the right arrow key — and it's thus the only column shown — you can keep scrolling horizontally within that field. See the 'C' interactive command below for more info. 🫶
Home:Jump-to-Home-Position Reposition the display to the un-scrolled coordinates. Home sweet home.End:Jump-to-End-Position Reposition the display so that the rightmost column reflects the last displayable field and the bottom task row represents the last task.
Note: from this position it's still possible to scroll down and right using the arrow keys. That stays true until a single column and a single task is left as the only display element.
C:Show-scroll-coordinates toggle Toggle an informational message that gets displayed whenever the message line isn't otherwise being used. That message takes one of two forms, depending on whether or not a variable width column has also been scrolled.
scroll coordinates: y = n/n (tasks), x = n/n (fields)
scroll coordinates: y = n/n (tasks), x = n/n (fields) + nnThe coordinates shown as n/n are relative to the upper left corner of the 'current' window. That extra + nn represents the displacement into a variable width column when it's been scrolled horizontally. Such displacement happens in normal 8 character tab stop amounts via the right and left arrow keys.
y = n/n (tasks)The firstnrepresents the topmost visible task and is controlled by scrolling keys. The secondnis updated automatically to reflect total tasks.x = n/n (fields)The firstnrepresents the leftmost displayed column and is controlled by scrolling keys. The secondnis the total number of displayable fields and is established with the'f'interactive command.
The above interactive commands are always available in full-screen mode but never available in alternate-display mode if the 'current' window's task display has been toggled Off.
Note: when any form of filtering is active, you can expect some slight aberrations when scrolling since not all tasks will be visible. This is particularly apparent when using the Up/Down arrow keys. It's giving chaos, but it's fine. 💀
5d. SEARCHING in a Window
You can use these interactive commands to locate a task row containing a particular value. Detective era. 🔍
L:Locate-a-string You'll be prompted for the case-sensitive string to locate, starting from the current window coordinates. There are no restrictions on search string content. Searches are not limited to values from a single field or column. All of the values displayed in a task row are allowed in a search string. You may include spaces, numbers, symbols and even forest view artwork. 🌈 Keying<Enter>with no input will effectively disable the'&'key until a new search string is entered.&:Locate-next Assuming a search string has been established,topwill attempt to locate the next occurrence.
When a match is found, the current window is repositioned vertically so the task row containing that string is first. The scroll coordinates message can provide confirmation of such vertical repositioning (see the 'C' interactive command). Horizontal scrolling, however, is never altered via searching. Periodt.
The availability of a matching string will be influenced by the following factors.
- a. Which fields are displayable from the total available, see topic 3b. MANAGING Fields.
- b. Scrolling a window vertically and/or horizontally, see topic 5c. SCROLLING a Window.
- c. The state of the command/command-line toggle, see the
'c'interactive command. - d. The stability of the chosen sort column, for example
PIDis good but%CPUbad. 💅
If a search fails, restoring the 'current' window home (unscrolled) position, scrolling horizontally, displaying command-lines or choosing a more stable sort field could yet produce a successful '&' search. Manifest it bestie. ✨
The above interactive commands are always available in full-screen mode but never available in alternate-display mode if the 'current' window's task display has been toggled Off.
5e. FILTERING in a Window
You can use this 'Other Filter' feature to establish selection criteria which will then determine which tasks are shown in the 'current' window. Such filters can be made persistent if preserved in the rcfile via the 'W' interactive command. 🎀
Establishing a filter requires: 1) a field name; 2) an operator; and 3) a selection value, as a minimum. This is the most complex of top's user input requirements so, when you make a mistake, command recall will be your friend. Remember the Up/Down arrow keys or their aliases when prompted for input. Fr fr. 🫶
Filter Basics
- field names are case sensitive and spelled as in the header
- selection values need not comprise the full displayed field
- a selection is either case insensitive or sensitive to case
- the default is inclusion, prepending
'!'denotes exclusions - multiple selection criteria can be applied to a task window
- inclusion and exclusion criteria can be used simultaneously
- the 1 equality and 2 relational filters can be freely mixed
- separate unique filters are maintained for each task window
If a field is not turned on or is not currently in view, then your selection criteria will not affect the display. Later, should a filtered field become visible, the selection criteria will then be applied. Sneaky but iconic. 👑
Keyboard Summary
O:Other-Filter (upper case) You'll be prompted to establish a case sensitive filter.o:Other-Filter (lower case) You'll be prompted to establish a filter that ignores case when matching.^O:Show-Active-Filters (Ctrl key + ‘o’)
bestie this one is your little filter mood board ✨ It reminds you which filters are currently active in the ‘current’ window. A summary pops up on the message line and just stays there until you hit the <Enter> key. like a lil sticky note for your brain 🫶
=:Reset-Filtering in current window
This nukes all your selection criteria in the ‘current’ window. 💅 But heads up, it's not a one-trick pony — it has additional impact, so pls go look at topic 4a. GLOBAL Commands.
+:Reset-Filtering in all windows
This clears the selection criteria in all windows, assuming you're in alternate-display mode. And same energy as the ‘=’ interactive command — it also has additional consequences, so you might wanna peek at topic 5b. COMMANDS for Windows.
🌸 Input Requirements 🌸
When you get prompted for selection criteria, the data you drop has to take one of two forms. There are 3 required pieces of info, with a 4th that's optional. These examples use spaces for clarity but your input generally would not.
#1 #2 #3 ( required )
Field-Name ? include-if-value
! Field-Name ? exclude-if-value
#4 ( optional )Items #1, #3 and #4 should be self-explanatory, no cap. Item #2 is doing double duty — it represents both a required delimiter and the operator, which must be one of either equality (‘=’) or relation (‘<’ or ‘>’).
The ‘=’ equality operator only requires a partial match, and that can shrink your ‘if-value’ input requirements. 🎀 The ‘>’ or ‘<’ relational operators always employ string comparisons, even with numeric fields. They're designed to work with a field's default justification and with homogeneous data. When some field's numeric amounts have been subjected to scaling while others have not, that data is no longer homogeneous.
⚠️ real talk: if you establish a relational filter and you've changed the default Numeric or Character justification, that filter is likely to fail. And when a relational filter is applied to a memory field and you haven't changed the scaling, it may produce misleading results. This happens, for example, because ‘100.0m’ (MiB) would appear greater than ‘1.000g’ (GiB) when compared as strings. it's giving alphabet soup 😭
If your filtered results appear suspect, simply altering justification or scaling may yet achieve the desired objective. See the ‘j’, ‘J’ and ‘e’ interactive commands for additional information. iykyk
💀 Potential Problems 💀
These GROUP filters could produce the exact same results, or the second one might not display anything at all — just a blank task window. vibe check failed fr
GROUP=root ( only the same results when )
GROUP=ROOT ( invoked via lower case ‘o’ )Either of these RES filters might yield inconsistent and/or misleading results, depending on the current memory scaling factor. Or both filters could produce the exact same results.
RES>9999 ( only the same results when )
!RES<10000 ( memory scaling is at ‘KiB’ )This nMin filter illustrates a problem unique to scalable fields. This particular field can display a maximum of 4 digits, beyond which values are automatically scaled to KiB or above. So while amounts greater than 9999 exist, they will appear as 2.6m, 197k, etc.
nMin>9999 ( always a blank task window )not the blank window jumpscare 🙈
✨ Potential Solutions ✨
These examples illustrate how Other Filtering can be creatively applied to achieve almost any desired result. iconic behavior honestly Single quotes are sometimes shown to delimit the spaces which are part of a filter, or to represent a request for status (^O) accurately. But if you used them with if-values in real life, no matches would be found. do NOT actually do that
Assuming field nTH is displayed, the first filter will result in only multi-threaded processes being shown. It also reminds us that a trailing space is part of every displayed field. The second filter achieves the exact same results with less typing.
!nTH=‘ 1 ’ ( ‘’ for clarity only )
nTH>1 ( same with less i/p )With Forest View mode active and the COMMAND column in view, this filter effectively collapses child processes so that just 3 levels are shown.
!COMMAND=‘ ‘- ’ ( ‘’ for clarity only )The final two filters appear as in response to the status request key (^O). In reality, each filter would have required separate input. The PR example shows the two concurrent filters necessary to display tasks with priorities of 20 or more, since some might be negative. Then by exploiting trailing spaces, the nMin series of filters could achieve the failed ‘9999’ objective discussed above. slay, problem solved 💅
‘PR>20’ + ‘!PR=-’ ( 2 for right result )
‘!nMin=0 ’ + ‘!nMin=1 ’ + ‘!nMin=2 ’ + ‘!nMin=3 ’ ...💖 6. FILES 💖
okay so top keeps receipts, and this is where it keeps them. two flavors: your personal one and the system-wide ones. let's go. 🗂️
✨ 6a. PERSONAL Configuration File ✨
this is the file top makes or updates when you hit the W interactive command. it's literally your whole setup, saved.
the legacy version gets written as $HOME/.your-name-4-top + rc — and yes bestie, with a leading period, sneaky hidden file energy. 🙈
a newly created configuration file gets written as procps/your-name-4-top + rc — without a leading period. and that procps directory lives subordinate to either $XDG_CONFIG_HOME when that's set as an absolute path, or the $HOME/.config directory.
it is not intended to be edited by hand, but here's the general layout anyway, just so you know what you're looking at:
global # line 1: the program name/alias notation
" # line 2: id,altscr,irixps,delay,curwin
per ea # line a: winname,fieldscur
window # line b: winflags,sortindx,maxtasks,etc
" # line c: summclr,msgsclr,headclr,taskclr
global # line 15: additional miscellaneous settings
" # any remaining lines are devoted to optional
" # active ‘other filters’ discussed in section 5e above
" # plus ‘inspect’ entries discussed in section 6b belowheads up bestie: if a valid absolute path to the rcfile can't be established, then any customizations you make to a running top will be impossible to preserve. like, it's just gone. 💀
🦋 6b. ADDING INSPECT Entries 🦋
so you wanna use that Y interactive command? then you gotta add entries at the end of the top personal configuration file. no shortcuts, it's giving "put it at the bottom, periodt." 💅
each entry basically says "hey, read this file" or "hey, run this command/pipeline" and then whatever comes out gets shown in its own separate scrollable, searchable window. very main character. ✨
if you literally don't know where your top rcfile lives or what it's called, use the W interactive command to rewrite it and then write those details down. don't lose them. 🫶
you can add Inspect entries with a redirected echo, or by just editing the configuration file. now — redirecting an echo is risky bc you could overwrite the rcfile if it replaces (>) instead of appends (>>) to that file. conversely, if you use an editor, you gotta be careful not to corrupt existing lines, and some of those lines could contain unprintable data or unusual characters depending on which top version saved that configuration file in the first place. so. pick your chaos wisely. 😭
any Inspect entry that starts with a # character is ignored, no matter what's in it. otherwise, they're made of these 3 elements, and each one has to be separated by a tab character (so that's 2 \t total):
.type— literalfileorpipe.name— the selection shown on the Inspect screen.fmts— a string representing a path or command
the two types are not interchangeable, ok?? those designated file get accessed using fopen and must reference a single file in the .fmts element. entries specifying pipe employ popen, their .fmts element could contain many pipelined commands and — important — none of them can be interactive.
if the file or pipeline in your .fmts deals with the specific PID input, or accepted when prompted, then the format string must also contain the %d specifier. like these examples illustrate:
.fmts= /proc/%d/numa_maps
.fmts= lsof -P -p %dfor pipe type entries only, you may also wish to redirect stderr to stdout for a more comprehensive result. so the format string becomes:
.fmts= pmap -x %d 2>&1and here are examples of both types of Inspect entries as they might appear in the rcfile. the first entry will be ignored bc of that initial # character. for clarity, the pseudo tab depictions (^I) are surrounded by an extra space — but the actual tabs would not be. 🙈
# pipe ^I Sockets ^I lsof -n -P -i 2>&1
pipe ^I Open Files ^I lsof -P -p %d 2>&1
file ^I NUMA Info ^I /proc/%d/numa_maps
pipe ^I Log ^I tail -n100 /var/log/syslog | sort -Mrexcept for that commented entry above, these next examples show what could be echoed to get similar results, assuming the rcfile name was .toprc. however — bc of the embedded tab characters, each of these lines should be preceded by /bin/echo -e, not just a simple echo, so backslash interpretation works regardless of which shell you use:
"pipe\tOpen Files\tlsof -P -p %d 2>&1" >> ~/.toprc
"file\tNUMA Info\t/proc/%d/numa_maps" >> ~/.toprc
"pipe\tLog\ttail -n200 /var/log/syslog | sort -Mr" >> ~/.toprcif any inspect entry you create produces output with unprintable characters, they'll be displayed in either the ^C notation or the hexadecimal <FF> form, depending on their value. and yes, this applies to tab characters as well — those show up as ^I. if you want a truer representation, any embedded tabs should be expanded. this next example takes what could've been a file entry but employs a pipe instead, just so the embedded tabs get expanded:
# next would have contained ‘\t’ ...
# file ^I <your_name> ^I /proc/%d/status
# but this will eliminate embedded ‘\t’ ...
pipe ^I <your_name> ^I cat /proc/%d/status | expand -Note: some programs might rely on SIGINT to end. so if apipelike the one below is established, you must use Ctrl-C to terminate it in order to review the results. this is the single occasion where a^Cwill not also terminate top. iconic exception tbh. 😭
pipe ^I Trace ^I /usr/bin/strace -p %d 2>&1lastly — and this is the fun part — while pipe type entries have been discussed in terms of pipelines and commands, literally nothing prevents you from including shell scripts as well. maybe even brand new scripts you made specifically for that Y interactive command. do your thing. ✨
for example: as the number of your Inspect entries grows over time, the Options: row will be truncated when the screen width is exceeded. that doesn't affect operation, other than making some selections invisible. however, if some choices get lost to truncation but you still wanna see more options, there's an easy solution hinted at below:
Inspection Pause at pid ...
Use: left/right then <Enter> ...
Options: help 1 2 3 4 5 6 7 8 9 10 11 ...the entries in the top rcfile would have a number for the .name element, and the help entry would identify a shell script you've written explaining what those numbered selections actually mean. that way, many more choices can be made visible. big brain energy fr fr. 🧠💅
🌸 6c. SYSTEM Configuration File 🌸
this one is basically the default vibes for users who have not saved their own configuration file. the format mirrors the personal configuration file exactly, and it can also include inspect entries as explained above.
creating it is a simple process:
- Configure top appropriately for your installation, and preserve that configuration with the
Winteractive command. - Add and test any desired
inspectentries. - Copy that configuration file to the /etc/ directory as
topdefaultrc.
boom. done. slay. 🎀
🎀 6d. SYSTEM Restrictions File 🎀
the mere presence of this file influences which version of the help screen gets shown to an ordinary user.
but more importantly — it limits what ordinary users are allowed to do when top is running. they will not be able to issue the following commands:
k Kill a task
r Renice a task
d or s Change delay/sleep intervalthis configuration file is not created by top. nope. it's created manually and placed in the /etc/ directory as toprc.
it should have exactly two lines, as shown in this example:
s # line 1: secure mode switch
5.0 # line 2: delay interval in seconds⭐ 7. ENVIRONMENT VARIABLE(S) ⭐
for the following, the value you set is unimportant — it's just the presence of it that matters. vibe check: are you there or not. 👑
LIBPROC_HIDE_KERNEL— this will prevent display of any kernel threads, and exclude such processes from the summary area Tasks/Threads counts.
💖 ok and now the plot thickens, bc there's more where this came from...
💅 8. STUPID TRICKS Sampler 💅
Many of these tricks work best when you give top a scheduling boost. So plan on starting him with a nice value of -10, assuming you've got the authority. 👑
🦋 8a. Kernel Magic 🦋
For these stupid tricks, top needs full-screen mode.
- The user interface, through prompts and help, intentionally implies that the delay interval is limited to tenths of a second. However, you're free to set any desired delay. If you want to see Linux at his scheduling best, try a delay of
.09seconds or less. ⏱️
For this experiment, under x-windows open an xterm and maximize it. Then do the following:
- provide a scheduling boost and tiny delay via:
nice -n -10 top -d.09- keep sorted column highlighting Off so as to minimize path length
- turn On reverse row highlighting for emphasis
- try various sort columns (
TIME/MEMwork well), and normal or reverse sorts to bring the most active processes into view
What you'll see is a very busy Linux doing what he's always done for you, but there was no program available to illustrate this. 😭🔥
- Under an xterm using ‘white-on-black’ colors, on top's Color Mapping screen set the task color to black and be sure that task highlighting is set to bold, not reverse. Then set the delay interval to around
.3seconds.
After bringing the most active processes into view, what you'll see are the ghostly images of just the currently running tasks. 👻
- Delete the existing rcfile, or create a new symlink. Start this new version then type
T(a secret key, see topic 4c. Task Area Commands, SORTING) followed byWandq. Finally, restart the program with-d0(zero delay).
Your display will be refreshed at three times the rate of the former top, a 300% speed advantage. As top climbs the TIME ladder, be as patient as you can while speculating on whether or not top will ever reach the top. 🏔️
🎀 8b. Bouncing Windows 🎀
For these stupid tricks, top needs alternate-display mode.
- With 3 or 4 task displays visible, pick any window other than the last and turn idle processes Off using the
icommand toggle. Depending on where you appliedi, sometimes several task displays are bouncing and sometimes it's like an accordion, as top tries his best to allocate space. 🪗 - Set each window's summary lines differently: one with no memory (
m); another with no states (t); maybe one with nothing at all, just the message line. Then hold downaorwand watch a variation on bouncing windows -- hopping windows. 🐇 - Display all 4 windows and for each, in turn, set idle processes to Off using the
icommand toggle. You've just entered the "extreme bounce" zone. 💀
🐦 8c. The Big Bird Window 🐦
This stupid trick also requires alternate-display mode.
- Display all 4 windows and make sure that
1:Defis the ‘current’ window. Then, keep increasing window size with theninteractive command until all the other task displays are "pushed out of the nest". 🪹
When they've all been displaced, toggle between all visible/invisible windows using the _ command toggle. Then ponder this:
is top fibbing or telling honestly your imposed truth? 🤔
🔄 8d. The Ol' Switcheroo 🔄
This stupid trick works best without alternate-display mode, since justification is active on a per window basis.
- Start top and make
COMMANDthe last (rightmost) column displayed. If necessary, use theccommand toggle to display command lines and ensure that forest view mode is active with theVcommand toggle.
Then use the up/down arrow keys to position the display so that some truncated command lines are shown (+ in last position). You may have to resize your xterm to produce truncation.
Lastly, use the j command toggle to make the COMMAND column right justified.
Now use the right arrow key to reach the COMMAND column. Continuing with the right arrow key, watch closely the direction of travel for the command lines being shown.
some lines travel left, while others travel right
eventually all lines will Switcheroo, and move right
🐛 9. BUGS 🐛
Please send bug reports to procps@freelists.org. 📬
👀 10. SEE Also 👀
free(1), ps(1), uptime(1), atop(1), slabtop(1), vmstat(8), w(1)
this page is from procps-ng, dated 2025-03-13, for TOP(1). periodt 💅✨
📦 where this page comes from
- arch rolling: procps-ng 4.0.7-1 · GPL AND LGPL
- nixpkgs unstable: procps 4.0.7
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms