CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Process Management / top

top

Watch CPU, memory and processes live

Beginneressentialmonitoringperformance

top is a live, refreshing view of the system: load average, CPU split (user, system, iowait, steal), memory and swap, then the busiest processes. It is installed everywhere, so it is the first thing to run when someone says 'the server is slow'.

Syntaxtop [-b] [-n COUNT] [-d SECONDS] [-p PID,...] [-u USER] [-o FIELD]

Watch it run

Users say the API is slow. Take one look at the whole box before you guess at causes.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
top

Read top to bottom. Load 3.84 on a 4-core box and rising (1-minute is higher than 15-minute). 88.9 us means user-space code is burning the CPUs, not the kernel or disk waits. Three python3 workers each hold a full core, starving node.

Anatomy of a command

$
commandtop

procps-ng top: samples /proc repeatedly and redraws the screen every 3 seconds by default.

How it works

top reads the same /proc files as ps, but it reads them twice and works out rates. Each refresh it reads /proc/stat (total CPU ticks spent in user, nice, system, idle, iowait, irq, softirq, steal), /proc/meminfo, /proc/loadavg and /proc/PID/stat for every process. A process's %CPU is the ticks it used since the last refresh divided by the interval, so it is current, and it is per CPU: a process using two full cores shows 200% (press I to toggle Irix mode off and divide by the core count). The first iteration has no previous sample, which is why the first batch-mode screen is less accurate. The summary's 'avail Mem' comes from MemAvailable, the kernel's estimate of memory that can be used without swapping.

Options you'll actually use

-d SECSRefresh interval (default 3.0 seconds)
-n NExit after N refreshes
-bBatch mode: plain output for logs, scripts and pipes
-p PID,...Monitor only these PIDs (up to 20)
-u USEROnly this user's processes
-o FIELDSort field: %CPU, %MEM, TIME+, RES ...
-HShow individual threads instead of processes
-cShow full command lines instead of program names
1 (key)Interactive: toggle one line per CPU core
P / M / T (keys)Interactive: sort by CPU / memory / cumulative time
k / r (keys)Interactive: kill or renice a PID
q (key)Quit

Common mistakes

Panicking at 'free 412.6' in the Mem line

Linux uses spare RAM as page cache, so free is always small on a healthy box. The cache is given back on demand.

Look at 'avail Mem' at the end of the Swap line
Reading a process at 380% CPU as a bug in top

Per-process %CPU is relative to one core by default (Irix mode). A 4-thread process on 4 cores can show 400%.

Press 1 to see per-core lines, or Shift-I to divide by core count
top -n 1 > snapshot.txt

Without -b, top writes terminal control codes into the file and may complain about the terminal.

top -b -n 1 > snapshot.txt
Assuming high load average means CPU is the bottleneck

On Linux, load counts D-state tasks waiting on disk or NFS too. Load 6 with 50% wa is an I/O problem.

Check wa and st in the %Cpu line, then iostat -x 1

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Take a single plain-text snapshot of top and save it to ~/top.txt.

  2. 2

    Show only your own processes in one top snapshot, sorted by memory.

  3. 3

    Start `sleep 300 &`, then watch only that PID with top for three 1-second samples.

  4. 4

    Run top interactively, show per-CPU lines, sort by memory, then quit.

Related commands

htopInteractive process viewer with bars and a treepsSnapshot the running processesuptimeHow long the system has run, and its load averagevmstatReport CPU, memory, swap and I/O activity over timefreeShow used, free and available memory
PreviouspsNexthtop
Linux / Process Management / top

top

Watch CPU, memory and processes live

Beginneressentialmonitoringperformance

top is a live, refreshing view of the system: load average, CPU split (user, system, iowait, steal), memory and swap, then the busiest processes. It is installed everywhere, so it is the first thing to run when someone says 'the server is slow'.

Syntaxtop [-b] [-n COUNT] [-d SECONDS] [-p PID,...] [-u USER] [-o FIELD]

Watch it run

Users say the API is slow. Take one look at the whole box before you guess at causes.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
top

Read top to bottom. Load 3.84 on a 4-core box and rising (1-minute is higher than 15-minute). 88.9 us means user-space code is burning the CPUs, not the kernel or disk waits. Three python3 workers each hold a full core, starving node.

Anatomy of a command

$
commandtop

procps-ng top: samples /proc repeatedly and redraws the screen every 3 seconds by default.

How it works

top reads the same /proc files as ps, but it reads them twice and works out rates. Each refresh it reads /proc/stat (total CPU ticks spent in user, nice, system, idle, iowait, irq, softirq, steal), /proc/meminfo, /proc/loadavg and /proc/PID/stat for every process. A process's %CPU is the ticks it used since the last refresh divided by the interval, so it is current, and it is per CPU: a process using two full cores shows 200% (press I to toggle Irix mode off and divide by the core count). The first iteration has no previous sample, which is why the first batch-mode screen is less accurate. The summary's 'avail Mem' comes from MemAvailable, the kernel's estimate of memory that can be used without swapping.

Options you'll actually use

-d SECSRefresh interval (default 3.0 seconds)
-n NExit after N refreshes
-bBatch mode: plain output for logs, scripts and pipes
-p PID,...Monitor only these PIDs (up to 20)
-u USEROnly this user's processes
-o FIELDSort field: %CPU, %MEM, TIME+, RES ...
-HShow individual threads instead of processes
-cShow full command lines instead of program names
1 (key)Interactive: toggle one line per CPU core
P / M / T (keys)Interactive: sort by CPU / memory / cumulative time
k / r (keys)Interactive: kill or renice a PID
q (key)Quit

Common mistakes

Panicking at 'free 412.6' in the Mem line

Linux uses spare RAM as page cache, so free is always small on a healthy box. The cache is given back on demand.

Look at 'avail Mem' at the end of the Swap line
Reading a process at 380% CPU as a bug in top

Per-process %CPU is relative to one core by default (Irix mode). A 4-thread process on 4 cores can show 400%.

Press 1 to see per-core lines, or Shift-I to divide by core count
top -n 1 > snapshot.txt

Without -b, top writes terminal control codes into the file and may complain about the terminal.

top -b -n 1 > snapshot.txt
Assuming high load average means CPU is the bottleneck

On Linux, load counts D-state tasks waiting on disk or NFS too. Load 6 with 50% wa is an I/O problem.

Check wa and st in the %Cpu line, then iostat -x 1

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Take a single plain-text snapshot of top and save it to ~/top.txt.

  2. 2

    Show only your own processes in one top snapshot, sorted by memory.

  3. 3

    Start `sleep 300 &`, then watch only that PID with top for three 1-second samples.

  4. 4

    Run top interactively, show per-CPU lines, sort by memory, then quit.

Related commands

htopInteractive process viewer with bars and a treepsSnapshot the running processesuptimeHow long the system has run, and its load averagevmstatReport CPU, memory, swap and I/O activity over timefreeShow used, free and available memory
PreviouspsNexthtop