When should I use ps instead?

`top` refreshes, so it is for watching what is heavy right now. `ps` prints one snapshot, which is what you want when piping or keeping the output.

How do I read load average?

It is the average length of the run queue over 1, 5 and 15 minutes. Compare it with the number of CPU cores; consistently above that means the machine is not keeping up.

Can I use it in a script?

`top -b -n 1` prints one round as ordinary output. `-b` is batch mode and `-n 1` stops after one iteration.

How do I read the memory line?

Look at `avail Mem` rather than `free`. Anything in buff/cache is handed back when a program needs it, so memory that looks used often is not.

← Linux command list

top command: find what is eating the machine

__ __ _ _____

\ \ / /__| |_|_ _|__ _ __ _ __ ___

\ \ /\ / / _ \ '_ \| |/ _ \ '__| '_ ` _ \

\ V V / __/ |_) | | __/ | | | | | |

\_/\_/ \___|_.__/|_|\___|_| |_| |_| |_

A sandbox for trying top. Nothing here can touch your real files.

user@webterm:~/project$

top shows running processes and keeps refreshing. Learn how to read the screen, how to get out, and how `-b` makes it usable from a script, by running the commands in a real terminal in your browser.

Updated: 2026-09-07

Syntax

top [options]

It lists running processes, heaviest first, and keeps refreshing.

Try it first

$ top

The screen switches to a process list and the numbers keep updating. Press q to get back (Ctrl+C also works).

Reading the screen

The top five lines summarise the machine; below them is the process list.

Line	What to read
`top - ...`	Current time, uptime, load average
`Tasks:`	How many processes, and in which states (running / sleeping / zombie)
`%Cpu(s):`	CPU breakdown; `id` is how much is idle
`MiB Mem :`	Memory; `avail Mem` on the right is what is really available
`MiB Swap:`	Swap; growing `used` means memory pressure

The list is sorted by %CPU, so the top row is whatever is heavy right now.

Load average covers 1, 5 and 15 minutes. Read it against the core count: staying above that means work is queueing up.

One round only

-b (batch) with -n 1 prints a single round as ordinary output instead of taking over the screen.

$ top -b -n 1
top - 17:33:40 up 10:30:45, 2 users,  load average: 0.12, 0.15, 0.10
Tasks: 12 total,   2 running, 10 sleeping,   0 stopped,   0 zombie
%Cpu(s):  3.0 us,  1.3 sy,  0.0 ni, 95.4 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :   7948.0 total,   1843.0 free,   3277.0 used,   2828.0 buff/cache
MiB Swap:   2048.0 total,   1920.0 free,   128.0 used.   4200.0 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
 3456 user       20   0  446.1m   85.6m   59.9m R  98.5   4.2   2:34:56 python3
 2345 user       20   0   11.0m    1.2m    987k R   1.5   0.0   0:00.01 top
 2847 user       20   0  337.6m   55.5m   38.8m S   1.2   1.5      1:23 node
  123 root       20   0  117.5m    9.6m    6.8m S   0.3   0.2      0:01 systemd-j
 1234 user       20   0   22.9m    3.4m    2.4m S   0.2   0.1      0:00 zsh
  789 user       20   0   44.6m    5.3m    3.7m S   0.1   0.1      0:00 sshd
    1 root       20   0  165.3m   12.8m    9.0m S   0.0   0.1      0:02 systemd
    2 root       20   0      0k      0k      0k S   0.0   0.0      0:00 kthreadd
  456 root       20   0   44.6m    5.3m    3.7m S   0.0   0.1      0:00 sshd
 5678 root       20   0   12.1m    2.3m    1.6m S   0.0   0.0      0:00 crond
  301 root       20   0    5.5m    1.2m    863k S   0.0   0.0      0:00 networking
  201 systemd-   20   0   24.0m    6.6m    4.6m S   0.0   0.1      0:01 systemd-r

python3 is using 98.5 percent of the CPU. This is the form to use when you want to keep the evidence or append it to a log.

The same thing with ps

ps can produce the same order.

$ ps aux | sort -k3 -nr | head -3
user        3456 98.5  4.2  456789  87654 pts/0    R    09:15   154:56 python3 backup_sync.py
user        2847  1.2  1.5  345678  56789 pts/0    S    10:35     1:23 node server.js
root         123  0.3  0.2  120344   9876 ?        Ss   00:01     0:01 /lib/systemd/systemd-journald

-k3 sorts on the third column, %CPU, and -nr sorts numerically, largest first. top to watch, ps to pass along.

When you actually reach for it

top is the first screen you open when someone says the server is slow.

Situation	What to type
See what is heavy	`top`
Keep a record of it	`top -b -n 1 >> load.log`
Just the three heaviest	`ps aux \| sort -k3 -nr \| head -3`
Check memory headroom	`free -h`
Stop the culprit	`kill <PID>`

Find the PID with top, stop it with kill. The two go together.

Things that trip people up

q is the way out. Ctrl+C ends it as well, but q is the proper key.

%CPU is an instant reading. A brief spike can be perfectly normal. Read it together with TIME+, the total CPU time that process has used, to tell a spike from a long burn.

Read avail Mem, not free. A small "free" number is fine when buff/cache is large, because that memory is handed back on demand.

It is a screen, not a tool for scripts. For automated records use top -b -n 1, or ps.

Practise it hands-on

webterm.appthis site

Advanced Terminal Commands
Learn commands for specific situations
Try the tutorial

learn.webterm.appa separate site

>_WEBTERM LEARN

WebTerm Learn: from one command to actually using it

Commands stick when they show up in a real sequence of work, not one at a time. There is a course that builds them up in order.

See the course

Related commands

ps / kill / free / df

Frequently asked questions

How do I get out of top?: Press `q`. Ctrl+C works too.
When should I use ps instead?: `top` refreshes, so it is for watching what is heavy right now. `ps` prints one snapshot, which is what you want when piping or keeping the output.
How do I read load average?: It is the average length of the run queue over 1, 5 and 15 minutes. Compare it with the number of CPU cores; consistently above that means the machine is not keeping up.
Can I use it in a script?: `top -b -n 1` prints one round as ordinary output. `-b` is batch mode and `-n 1` stops after one iteration.
How do I read the memory line?: Look at `avail Mem` rather than `free`. Anything in buff/cache is handed back when a program needs it, so memory that looks used often is not.