Top in Linux

Top is a Linux utility to see the running state of the system. Let's see what each fields in the top 

output means. To see top, go to a Linux shell and on prompt type

top

It will show a set of parameters which refreshes automatically.

Linux Top

Let's look into the details of each line and what it means. The number differ from what is in image and what I might be using below as they are taken from two different machines. In any case ignore the numbers as if you run top in your environment you will see different set of numbers. Let's focus on what the number signifies

First line. We can get the same information by using uptime command.

top - 17:43:17 up 4 days, 22:01,  5 users,  load average: 7.06, 4.24, 4.39

• 17:43:17 up 4 days 22:01  -  Current time and for how long the server is up. Here it is up for 4 days, 22 hours and 1 minute. 
• 5 users - Number of users logged into the system. If same login is used to log into the system from two places, it will be count as 2. Also every term spawned will add to the user count.
• load average: 7.06, 4.24, 4.39  - It's the average load on machine in 1, 5 and 15 minute interval. 

Generally you can take your (number of processor * number of core) as the number against which this number should be looked into. For example a dual processor 4 core machine can have load of 8. 

Anything below this is good. A good benchmark is to have machines loaded at 70%, so in this case 70% of 8 is 5.6 and the load numbers especially in 5 minute and 15 minute values should be less than this. Anything above that is a sign of trouble. 

Next line is

Tasks: 108 total,   5 running, 103 sleeping,   0 stopped,   0 zombie

• 108 total - Total number of processes
• 5 running -  5 are active
• 103 sleeping - At the moment when top snapshot is taken, 103 sleeping.
• 0 stopped - Processes stopped
• 0 zombie - Processes that have exited but not removed from the process table. A zombie process usually indicates bug in a parent program terminating it's child process. 

Third line

Cpu(s): 90.6%us,  8.9%sy,  0.0%ni,  0.0%id,  0.3%wa,  0.0%hi,  0.2%si,  0.0%st

• 90.6%us - Time spent in user processes
• 8.9%sy -  Time spent in system/kernel processes
• 0.0%ni - Time spent on low priority processes
• 0.0%id - Idle time when CPU is doing nothing
• 0.3%wa - Time when CPU is waiting on IO
• 0.0%hi - Time spent in hardware interrupts
• 0.2%si - Time spent in software interrupts
• 0.0%st - Relevant in virtualized environment. It's the time stolen by Hypervisor from one VM to run another VM

Fourth line. We can get the details of Mem and Swap by using free command in Linux

Mem:   4109100k total,  4088952k used,    20148k free,    25404k buffers

• 4109100k total - Total RAM available. Total = Used + Free
• 4088952k used -  Used memory
• 20148k free - Free memory. 
• 25404k buffers -  Memory used for data I/O operation. It could be data waiting to be written to disk. This memory is included in the 'used' portion of memory.

Fifth line

Swap:  1999992k total,   163540k used,  1836452k free,  1593204k cached

• 1999992k total -  Total swap memory 
• 163540k used - Swap memory used
• 1836452k free - Free memory in swap. Again Total = Used + Free
• 1593204k cached -  Though it's shown against swap, but this a memory used for caching as in fourth line. This memory is also included in 'used' portion of memory. The kernel uses cache to improve performance. For example kernel may cache a file from disk for faster access. This memory is used in an unobtrusive way and the memory is released if other processes need it.

Let's now look into the parameter shown against each process:

• PID - process id of each task. This is a unique number given by Linux.
• USER - User who has started the process. Also the process works under the security credentials of this user.
• PR - Dynamic priority as assigned by kernel during executing process
• NI - Also known as nice priority. This is the static priority assigned to task when it is started.
• VIRT - Memory allocated to the process
• RES - Memory used by process
• SHR - Share is the memory used by shared libraries used by the task. So actual memory consumption of a task is between RES and (RES - SHR)
• S - Status of task 

                  D - uninterruptible sleep 

                R - running 

                S - sleeping 

                T - stopped 

                Z - zombie

• %CPU - CPU %age used by this task
• %MEM - Memory %age used by this task
• TIME+ - Time that the process is running. The granularity is in hundredth of second.
• COMMAND - Task name

Hopefully this will enable you to read top in a better way. There are more things than the defaults as covered in this article. You can type h on the top window and can look into detailed help.