How to Use the top Command to Monitor Linux System Resources

When a Linux server suddenly becomes unresponsive or a web application begins returning 504 Gateway Timeout errors, the first thing a systems administrator needs to know is what is consuming the server’s resources. Without a graphical Task Manager, you must rely on the terminal. While there are modern alternatives, the undisputed, universally installed standard for real-time system monitoring is the top command.

The top command provides a live, continuously updating dashboard of your system’s CPU usage, memory consumption, and a ranked list of the exact processes causing the strain. In this guide, you will learn how to read its dense interface and use it to identify rogue applications.

Launching and Reading the top Interface

To start the monitor, simply open your terminal and type:

top

The screen will instantly clear and be replaced by a dense wall of text that refreshes every 3 seconds. The interface is divided into two main sections: the Summary Area at the top, and the Task Area at the bottom.

The Summary Area (System Health)

The top five lines give you the macro view of your server’s health.

• Line 1 (top): Shows the current time, how long the server has been running (uptime), and the load average (1-minute, 5-minute, and 15-minute averages). A load average higher than your total number of CPU cores indicates the server is overworked.
• Line 2 (Tasks): Shows how many processes are running, sleeping, stopped, or “zombie” (dead processes that haven’t been cleared).
• Line 3 (%Cpu(s)): This is critical. Look at the id (idle) value. If id is at 0.0%, your CPU is completely maxed out. If it is at 95.0%, your server is barely doing any work.
• Lines 4 & 5 (MiB Mem / MiB Swap): Shows your total, free, and used RAM. If the “free” memory is consistently near zero and your server is heavily using the “Swap” space (which uses the slow hard drive as emergency RAM), your server needs a physical memory upgrade immediately.

The Task Area (The Process List)

Below the summary is a list of individual processes, ranked by CPU usage.

• PID: The Process ID. You need this number if you want to kill the process.
• USER: The account running the application (e.g., root or www-data).
• %CPU & %MEM: Exactly how much of the system’s total resources this specific application is currently burning.
• COMMAND: The name of the application (e.g., mysqld for a database, or php-fpm for web rendering).

Interactive Commands (Sorting and Killing)

While top is running, you can press specific keys on your keyboard to change how the data is displayed. (Note: these keys are case-sensitive).

• Press M (Shift + m): This resorts the list based on Memory usage instead of CPU usage. This is essential if you suspect a memory leak is crashing the server.
• Press P (Shift + p): This resorts the list back to CPU usage (the default).
• Press u: This prompts you to type a username. top will then filter the list to only show processes owned by that specific user (e.g., type nginx and press Enter).

Killing a Rogue Process

If you see a rogue PHP script consuming 99% of your CPU, you can terminate it directly from within the top interface.

1. Note the number in the PID column for the rogue process (e.g., 14532).
2. Press the lowercase k key.
3. top will prompt you with “PID to signal/kill [default pid = X]”. Type 14532 and press Enter.
4. It will ask for the signal number. Press Enter to send the default, polite termination signal (SIGTERM 15). If the process refuses to die, press k again, enter the PID, and type 9 to send the aggressive “kill” signal (SIGKILL 9).

To exit the top dashboard and return to your normal command line, simply press q.

By understanding how to read the top command, you gain x-ray vision into your Linux server, allowing you to instantly diagnose crashes and eliminate resource bottlenecks.