Skip to content

SYSTEM Cited by 1 source

top (Linux)

What it is

top is the canonical interactive per-process resource monitor on Linux — system load, per-CPU summary, memory, swap, and a ranked list of processes by CPU / memory / I/O. Ships with every Linux distribution; reads from /proc.

Strengths

  • Single-screen summary that aggregates many signals: load average, task state counts, per-state CPU time breakdown, Mem / Swap totals, per-process detail.
  • Sanity check. Run it last in the 60-second checklist to see if anything is wildly different from the earlier commands. If vmstat / mpstat / pidstat painted one picture and top paints another, load is variable and something is moving.
  • Interactive filtering. Sort by M (memory), P (CPU), T (time); filter with u <user>; kill with k <PID>.

Weaknesses vs rolling tools

  • Screen-clearing hides temporal patterns. vmstat, pidstat, sar give you a row-per-sample scrolling history you can read as a time series. top shows the current snapshot only.
  • Hostile to copy-paste. The redraw hides most of what you want to capture in an incident record.
  • Ctrl-S / Ctrl-Q pause dance. You can freeze with Ctrl-S and resume with Ctrl-Q to snapshot — but evidence of intermittent issues "can also be lost if you don't pause the output quick enough."

When to reach for top vs pidstat

  • Interactive exploration (live incident on one host) → top.
  • Capture for a ticket / runbook → pidstat.
  • Historical comparison → sar + pidstat -l archives.
  • Fleet-wide context → Atlas / Prometheus / Datadog — not a CLI tool at all.

Example output from the Netflix checklist

top - 00:15:40 up 21:56,  1 user,  load average: 31.09, 29.87, 29.92
Tasks: 871 total,   1 running, 868 sleeping, ...
%Cpu(s): 96.8 us,  0.4 sy,  0.0 ni,  2.7 id,  0.1 wa,  0.0 hi,  0.0 si,  0.0 st

High load (31), us ≈ 97, sy ≈ 0.4, id ≈ 3, wa ≈ 0.1, no steal — user-space-bound, confirmed across the 10 commands.

Seen in

Last updated · 319 distilled / 1,201 read