How to Use the top Command in macOS Terminal with Custom Sorting and Metrics to Monitor Processes

While most Mac users monitor background system performance through the graphical Activity Monitor application, system administrators, software developers, and power users frequently require a lightweight, scriptable, and immediate command-line alternative. On macOS, the built-in top command provides a real-time, interactive terminal dashboard of CPU utilisation, physical and virtual memory allocation, thread activity, and disk I/O. However, because Darwin macOS is derived from the BSD Unix family rather than GNU/Linux, its native top utility features a distinct command syntax and powerful flags that differ significantly from typical Linux installations.

Understanding how to use the top command in macOS Terminal allows administrators to sort running processes by real-time CPU spikes, resident memory footprints (RSIZE), and internal page faults without opening bloated GUI monitors or installing external tools. This comprehensive guide details BSD top syntax, demonstrates custom sort flags, explains logging and sampling modes, and covers interactive keyboard commands for effective terminal-based process management.

BSD top Architecture vs. Linux procps top

Before launching the command, it is crucial to recognize how the macOS Darwin kernel implementation differs from standard Linux:

Operational Characteristic	macOS Darwin BSD top	Linux procps top
Default Process Sorting	Sorted by internal Process ID (PID) numerically by default.	Sorted by active percentage of CPU utilisation (%CPU).
Sort Flag Argument	Uses -o <key> (e.g., -o cpu or -o rsize).	Uses interactive keys or -o +%MEM.
Memory Architecture	Reports Mach virtual memory: Wired, Active, Inactive, Compressed.	Reports Linux virtual memory: Buffers, Cached, Free.
Logging / Batch Output	Controlled via the -l <samples> flag.	Controlled via the -b -n <iterations> flags.

Because macOS top orders by PID by default, simply running top without arguments does not display the highest CPU-consuming application at the top of your screen. Specifying sorting keys is therefore mandatory for productive troubleshooting.

Launching top with Custom Sorting Options

To identify resource-heavy applications immediately upon launch, pass the -o (order) flag followed by your desired sorting metric:

Sorting by Active CPU Usage

top -o cpu

This orders active processes descending by percentage of processor cycles consumed, placing unresponsive scripts, rogue browser processes, or compiling toolchains at the top of the terminal table.

Sorting by Resident Memory (RAM Footprint)

To inspect which applications occupy the largest amount of real, physical memory (excluding unpaged virtual swap):

top -o rsize

Here, RSIZE represents Resident Size (real physical RAM currently committed to the process). Other useful memory sort options include -o vsize (total Virtual Size) and -o psize (purged memory blocks).

Customising Update Intervals and Limiting Display Count

By default, top updates its sampling window every 1 second, which can cause text flicker over slow SSH connections. You can lengthen the sampling interval using the -s parameter and limit the number of visible processes using -n:

top -o cpu -s 3 -n 15

This command instructs top to sort by CPU usage, refresh the metrics every 3 seconds, and limit the on-screen list to the top 15 highest-consuming processes, keeping the display neat and focused.

Running top in Non-Interactive Logging Mode for Scripts

If you need to archive system health metrics to a log file or parse processor statistics inside a shell script, running top interactively is unsuitable because it continuously controls the terminal buffer. Use the -l (logging mode) parameter followed by the number of snapshots you wish to capture.

To output 1 snapshot and exit cleanly to stdout:

top -l 1 -n 10 -o cpu

You can redirect this structured snapshot directly into a timestamped forensic report:

top -l 1 -n 20 -o cpu > ~/Desktop/system_snapshot.txt

To monitor a background compiling job over 30 seconds, taking 6 samples at 5-second intervals:

top -l 6 -s 5 -o rsize > ~/memory_audit.log

Interactive Keyboard Commands Reference in macOS top

While top is running inside your active terminal window, you can press individual keyboard hotkeys to reconfigure sorting, apply filters, or terminate unresponsive tasks without exiting the program:

Hotkey	Interactive Action
o	Prompts you to type a new primary sort key (e.g., type cpu, rsize, time, or threads and hit Enter).
O	Prompts you to specify a secondary sort key for processes with equal primary values.
u	Filters the process table to display only tasks owned by your current user account, hiding system daemons.
U	Prompts you to enter a specific username (e.g., root or staff) to filter by. Pressing U again with no input clears the filter.
S	Sends a Unix signal to a process. Prompts for the target PID followed by the signal name or number (e.g., 9 for SIGKILL or 15 for SIGTERM).
q	Quits the top application immediately and restores standard terminal prompt focus.

Troubleshooting and Best Practices

When monitoring macOS processes from the terminal, keep the following diagnostic nuances in mind:

• Understanding CPU Percentages Over 100%: On macOS, 100% CPU represents one fully saturated physical or virtual CPU core. On an 8-core or 16-core Apple Silicon Mac (M1/M2/M3/M4), multi-threaded processes (such as video rendering in Final Cut Pro or building Xcode projects) can routinely display 400%, 800%, or higher.
• First Sample Inaccuracy in Logging Mode: When capturing a single snapshot with top -l 1, the initial CPU statistics represent an average since system boot rather than the immediate delta. For precise instantaneous measurements in scripts, capture two samples: top -l 2 -s 1 | tail -n 25.
• Missing Permission for Other Users: Running top as a standard user displays process command names but may obscure arguments or private kernel thread statistics of system daemons. Run with sudo top -o cpu if performing low-level security audits.

Mastering the native BSD top command in macOS Terminal equips administrators with an immediate, lightweight, and deeply configurable diagnostic monitor that operates seamlessly across local Terminal windows and remote SSH connections alike.