Bash List Processes (top)

Top Features

top

top -n 1

top -o %CPU

top -u username

🔹 Basic Usage

The tail command is a core utility for viewing the end portion of files, particularly useful for logs and large text files. Its default behavior, invoked simply as tail filename, is to output the last 10 lines to the terminal. This provides a quick, resource-efficient way to inspect the most recent entries without loading the entire file. It is indispensable for system administrators checking the latest system log entries (/var/log/syslog), developers verifying the end of application output, or anyone needing a snapshot of recent data. The command reads input from files or standard input, making it highly versatile in pipelines.

# Start top
top

# Press 'q' to quit
# Press 'h' for help

top - 10:30:45 up 5 days, 2:15, 3 users, load average: 0.52, 0.48, 0.45
Tasks: 245 total, 1 running, 244 sleeping, 0 stopped, 0 zombie
%Cpu(s): 12.5 us, 3.2 sy, 0.0 ni, 84.1 id, 0.2 wa
MiB Mem : 16384.0 total, 2048.5 free, 8192.3 used, 6143.2 buff/cache

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
 1234 user      20   0 1234567 123456  45678 S  25.0   5.2   1:23.45 firefox
 5678 user      20   0  987654  98765  32109 S  10.5   3.1   0:45.12 chrome

🔹 Understanding Top Display

The top interface presents a wealth of data that must be correctly interpreted to assess system health. The header shows uptime, user count, load averages (1, 5, 15 minutes), total/running/sleeping tasks, and detailed CPU states (%us user, %sy system, %ni nice, %id idle, etc.). The memory lines show used, free, buffered, and cached RAM. The process list columns include PID, USER, PR (priority), NI (nice value), VIRT (virtual memory), RES (resident memory), SHR (shared memory), %CPU, %MEM, TIME+ (CPU time), and COMMAND. Understanding these metrics is essential for performance analysis.

🔹 Interactive Commands

While top is running, you can use single-key commands to change its behavior without exiting. Press M to sort processes by memory usage (%MEM), P to sort by CPU usage (default), T to sort by time, k to kill a process (you'll be prompted for a PID), r to renice a process (change its priority), u to filter processes by a specific username, and h or ? to view the help screen. These interactive commands make top a powerful, on-the-fly process management tool.

🔹 Command Line Options

You can customize top's initial behavior by passing options when you start it from the command line. Useful options include: -d to set the delay between updates (e.g., top -d 1 for 1-second intervals), -n to run for a set number of iterations then exit, -p to monitor specific PIDs (e.g., top -p 1234,5678), -u to only show processes for a given user, and -b for batch mode (useful for scripting). These pre-set configurations allow you to tailor top for specific monitoring tasks right from launch.

# Update every 5 seconds
top -d 5

# Run once and exit (batch mode)
top -n 1

# Show only specific user's processes
top -u username

# Sort by memory usage
top -o %MEM

top - 10:30:45 up 5 days
Tasks: 245 total, 1 running
%Cpu(s): 12.5 us, 3.2 sy
MiB Mem : 16384.0 total

🔹 Batch Mode Output

Running top in batch mode with -b disables the interactive interface and sends output to stdout, making it suitable for scripts or logging. Combined with -n to limit iterations, it becomes a powerful tool for capturing snapshots. For example, top -b -n 1 > system_snapshot.txt writes one full report to a file. You can pipe this output to tools like grep or awk for automated analysis. This mode is essential for creating custom monitoring solutions, generating periodic reports, or feeding data into larger IT infrastructure management systems.

# Run once in batch mode
top -b -n 1

# Save output to file
top -b -n 1 > system_snapshot.txt

# Monitor for 3 iterations
top -b -n 3 -d 2 > monitoring.log

🔹 Filter and Search

top provides built-in filtering capabilities to focus on relevant processes. Press u followed by a username to display only that user's processes. Press o or O to add complex filters based on any field (e.g., COMMAND=nginx). You can also start top with the -p option to watch specific PIDs. These filtering features are invaluable when monitoring multi-user systems, tracking specific services, or isolating the behavior of a handful of critical applications from the noise of dozens of other running processes.

# Show only root processes
top -u root

# Show only your processes
top -u $USER

# Combine with other options
top -u username -d 3

🔹 Common Top Options

Mastering a core set of top command-line and runtime options transforms it from a simple viewer into a versatile system monitoring dashboard. Essential options include -d for update frequency, -b for scripting, -p for PID-specific monitoring, and -u for user filtering. Runtime commands like sort toggles (M, P), filtering (u), and process control (k, r) provide interactive control. Combining these allows you to adapt top on the fly for tasks ranging from general health checks to deep-dive performance troubleshooting of specific subsystems.

# Monitor specific PIDs
top -p 1234,5678

# Hide idle processes
top -i

# Show threads
top -H

🔹 Alternative: htop

htop is an enhanced, interactive process viewer that offers significant usability improvements over the traditional top command. It features a full-color display, vertical and horizontal scrolling, mouse support for clicking on columns and processes, visual meters for CPU and memory usage, and a cleaner, more intuitive layout. Tasks like searching, filtering, tree view, and killing processes are easier. While not always installed by default, htop is widely available and is often the preferred choice for system administrators seeking a more user-friendly and feature-rich real-time system monitor.

# Install htop (Ubuntu/Debian)
sudo apt install htop

# Install htop (macOS)
brew install htop

# Run htop
htop