hpr-knowledge-base/hpr_transcripts/hpr1052.txt

Episode: 1052
Title: HPR1052: LiTS 013: Top of Top
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr1052/hpr1052.mp3
Transcribed: 2025-10-17 17:59:56

---

Welcome to Linux in the Shell episode 13, the top of top.
Hello, my name is Dan Washko.
I'll be your host today for this episode 13 of Linux in the Shell.
We're going to start our discussion on top.
Now top is a fairly complex command with a lot of features to it.
So this is going to be a multi-part episode.
I don't know how many parts, probably through you, although I may be able to do it in two.
So what this episode is going to talk about today is just the top of top.
Now top is basically an application that aggregates complete system information of what's
running and how much resources are being utilized by whatever's running.
Top itself has two main sections.
There's the top of top which we'll be talking about today is the summary information.
And that's a section we'll cover each of those little bits and the summary information
in just a minute.
And then underneath that is the application field information.
And that lists the applications that are running and some information about the utilization
of those applications.
We're going to cover that section next time.
So let's jump right in and remember for the full right up of this and to get the notes
and the links and the bibliography head over to Linux in the Shell.org and check out
episode 13.
So when you fire up top by default, you're going to see a small section probably takes
about less than a quarter of the top screen itself, depending on your window size, but
it's about a quarter of the top screen for the summary information.
And there are default five lines there that will be of interest to you.
The first line shows the just basic CPU system information.
It's going to show you the time of day on your system.
And next to that it's going to show you the uptime and how many days, minutes, hours
and minutes that your system has been up.
It'll also show you next to that is how many users are logged into your system.
And then it's going to show you the CPU load averages.
Now remember, this value of CPU load averages is the same thing that I talked about a few
episodes ago was that episode nine, the W command and CPU load averages.
There are three values here for CPU load averages.
The first one is the load average over the past minute.
The second one is the load average over the past five minutes and then the third one
is the load average over the past 15 minutes.
Now remember, this doesn't mean percent utilization of your CPU.
What that actually means is the actual load on the system and how it's been handled by
the CPU.
That is, it's going to be a value from zero to some floating point number.
Now value from zero to one is where you actually want it to be between zero and point seventy
is the ideal place for a single CPU system, point seventy.
Anything that goes beyond point seven to nine to one, that's starting to be an indication
that your system is not handling the load that you're putting on.
If you see that occasionally, like if you're compiling an application, don't worry about
what it means.
When it reaches one, you can look at it and say, when the CPU load average reaches one,
that means my system is handling at max what I'm throwing at it.
You don't necessarily want it to be running at max.
If you're seeing one, the value of one across the one minute, the five minute, the 15,
you're seeing values beyond that, whatever you're doing with your system, you need to start
looking around for a process that's going to rye or your system is just not beefy enough
for the tasks that you have going on.
Again, the value exceeding one means that your system, your CPU, your system is, you would
need, in a nutshell, if it was at two and you had a single CPU system, you would need
a system that's two times as powerful to handle the load that you're asking it to handle.
And again, if it spikes up there once, twice, and you're compiling something or running
a game, you'll probably keep an eye on it.
But if it's a constant thing, then you have a problem.
Now again, this, in a multi-CPU system, the dual core, quad core, multi-core system,
multi-CPUs, this value increases with each CPU on the system reach core.
So if it's a dual core, it's a value between zero and two.
So if you see the system is running at 1.5, you don't need to really worry about it.
When it starts getting up to 1.7 or 1.8, then you've got to start watching what you're
doing with your system as a powerful amount.
So with each core, or each processor, you increase it by one.
So just be aware of that, of what's going on.
And I covered that completely in the W command on episode 8 or 9.
Check it out.
Now that covers basic first line information.
The second line shows you tasks on the system.
And that's broken down into a few columns.
First one is how many tasks are total on the system.
That'll give you a number there.
And then it'll show you how many are actually running, how many systems tasks are running,
and how many are sleeping.
So the values that you see, okay, there's two more, there's stop tasks, and there's zombie
tasks, we'll cover in a minute.
So all those values right there should equal the number of the total number of tasks.
So running and sleeping, that's pretty obvious, stopped.
And that is, is in a case, you know, an example of this, is if you're running a command,
maybe you're tarring up a large archive, you're extracting a large archive, you're tailing
a log file or something, and while it's running, you hit control Z to stop the process.
That would be in, you know, something that is stopped.
It's a process that's waiting to continue.
It would show up there as a stop process.
Then you would type four ground, percent one in it, and we continue on.
Zombie processes are a little bit different.
They're not stopped, the process is zombie process is, when a running process, when a process
is running, we'll call this the parent, spawns off another process, we call that the child.
When that child process spawns off the parent, the parent is supposed to issue a wake
command and continue to check status of the child process.
And then when the child process completes, it releases the resources it had, but it still
remains in a process table until the parent process acknowledges that the child process
is terminated via the wake command.
If something were to go wrong or the parent process hasn't called the wake command yet,
but the child process is finished, it's going to be sitting in the process table.
It's not running, it's not taking resources, but it's kind of considered a zombie process.
Now, if you see zombie processes start to build up, that could indicate there's a problem
with an application that you're running.
There's coded, it's not coded properly.
It could be a bug in the system, it could be poorly written process.
But anyway, that will show you right there as a good way to look for zombie processes in
the top command.
So if you start seeing a lot of zombie processes and they're building up and up and up, keep
a close eye on that, that could be a problem with one of the applications that you're running.
Third line, we come down to the percent CPU utilization.
Now, this is a little bit different than when we said load average to top.
What this is supposed to show you on this line, the CPU state percentages.
These are the values shown, there's a bunch of them here and there's a two character
abbreviation for what these mean, and I'll cover each one of those.
Okay, US, this is the first one.
It's the time running user unnice processes, normal processes that were started that weren't
nice or anything, adjust with the nice normal user processes that have not been adjusted
using the nice.
That shows you a percentage of the CPU being utilized by those.
Then there's system, system running kernel processes, the system running kernel processes,
stuff like that, that shows you the time the CPU percentage of the time was being utilized
running system processes or kernel processes.
Then there's, that's represented by SY, then there's NI.
Those are running user nice processes.
If a process was started and it's been nice or re-niced by the user or the user, it'll
show you the percentage of the CPU that has been taken up by normal user processes adjusted
by the nice company.
Then there's the fourth one is ID or idle, and that's the percent of the time the system
has been idle.
If you're just running on a standard desktop system and you fire it up and you're just,
you come, you sit down and you're not really doing anything, but you maybe have a bunch
of applications open, like a Firefox, Thunderbird, or some email application, maybe an XChat session,
and a lot of stuff is running in the background, you're not using it.
You might see the bulk of your CPU percentage time going to being idle, because idle of it
being idle.
Those processes or applications are probably sleeping in the background, not doing anything,
but you'll see the CPU is being mostly idle.
There's a few more columns here of values, is WA, and that's the percent of the time
the system has been waiting for interrupt IO completion.
Then you have two values, there's HI and SI, and that's the HI stands for hardware interrupts
and software stands for software interrupts, and that's the percent of the time the CPU
is handling hardware interrupts, and the percent of the time the CPU is handling software
interrupts.
The last column is pretty new, and unless you have an old, really old version at top, it
might not be there, but it is ST and that's for stolen.
That only really applies to virtual machines running by a hypervisor.
That'll show you the total amount of CPU stolen from the virtual machine by the hypervisor.
Chances are you'll never see that value escalating unless you're running virtual machines.
If you're in a virtualized environment, you see the value greater than zero.
What this means is that some other process, chances are it could be another virtual machine,
is stealing CPU time from the CPU that was allocated to your hypervisor, your VM session.
That's what the stolen time means right there.
If we add up all those values right there, they should equal 100%.
But if you take the percent idle, percent idle, no, percent, it should be the total sum
of all those other values subtracted from 100, and that should give you the percent idle.
That should match.
Those are what those values mean right there, the percent CPU over the time allocated
for the refresh interval.
Then there's two other, another thing that you can do then is that is showing you percent
CPU for your entire system.
If you have a single core system, single CPU, you see the percentages there.
If you have a multi-core system, it's showing you the percentages for the whole system.
If you were to press the one key with a multi-core system, it would expand, and you would
see those percentage values for each CPU core in there.
Now you have to be careful because by default, top is running in irix mode, what is called
irix mode.
If you have a multi-processor system, dual-core, multi-processors, what you're seeing
there is the default is to display the percentages per each CPU.
It treats each CPU with its own percentages.
Process that consumes 10% of the system time would consume 10% of one CPU, not necessarily
10% of the total CPU power.
Just be aware of how irix times handled.
You have to do that calculation in your mind.
10% is really horrible math, but look at it this way.
If you have two core processors, a dual-core system, in irix, you have to treat it 200%.
That's not really the way it works.
You might be taking up 10% of one CPU, but it'll show as being 10% of the entire system.
10% of one CPU where you actually have to realize it.
You have 200% power as opposed to 100% in irix thought processes.
If you switch it to solar, solarist mode, all CPU percentages are treated across as being
across all CPUs.
So a value of 10% would be calculated across both CPUs.
That means in the irix mode, you're looking at 10% of 200% in both your CPUs.
You might say, well, why doesn't it just show 5% while it doesn't, but that spread across
2%.
But in solarist mode, you're going to see that 10% of one CPU.
That's being utilized on one CPU, not 10% of the total CPU power, so just be aware of
that.
If you look at it, if in irix mode, it might show 10%, and that's across both CPUs.
It's a total of both CPUs, but in solarist mode, that 10% is no longer across all CPUs.
It might show like 15 or 20%, and it's probably not that clean, but for one CPU, so it's only
showing for one CPU.
Now you can switch between irix and solarist mode using the i button, the capital i.
That'll switch between the two modes in there.
So if you switch between the modes with one, you can toggle on displaying the multiple
CPUs in your system, and then you can toggle irix mode on and off, switch it to solarist
mode by typing a capital i, and then back to iris by hitting capital i again.
And if you press the one button, the one key, it will collapse the CPUs into one overall
value as opposed to showing each CPU individually.
Usually we come to the last line, last two lines of top, and this is memory information.
And this, what you're going to see in here is kind of like when we talk about the free
command, it shows you a line in kilobytes, or megabytes or gigabytes, depending on how
much memory you have in the system, it adjusts itself, and you're probably going to see
it in kilobytes.
But it shows you your quote, physical memory, how much you have total, how much is being
used, how much is free, and how much is allocated to buffers.
And then underneath that is swap information, how much swap you have, how much is being
used, how much is free, and how much is being allocated for cash.
Remember, don't start to get overly alarmed if you see that you're using a lot more memory
than you think you should be, and that you don't have the total amount free that you expect.
Be aware that this works kind of similarly, it's the way free command works that we talked
about on episode eight, that when the kernel will allocate a physical memory towards the
cash buffer.
So we might show you utilizing like 80% of your memory, you got to look at what's going
on into what's being used as buffers and what's being used as cash to cash buffers, you
need to take those values and kind of subtract them out of the total memory being used to
see how much you actually have being utilized to applications.
Now of course, if you're running applications, there's a process going wild, and you're
seeing your memory used to spike up, you know, taking the consideration that if your memory
usage is high, but your buffers and cash is really low, and you don't have a lot of free
memory, that's a good indication that something is, your system's not being able to handle
what you're throwing at it.
So just be aware of that, those two bottoms show you memory usage and swap usage, and
just be aware of that as we discussed on the free command, what those actually mean.
For the summary section, there are a few things that you can adjust, some flags that you
can set, there's also some keys, key combinations that allow you how keys to do different things.
Defaults Refresh Interval is three seconds, so when you stop, start top by default, it's
going to run and refresh itself every three seconds.
You can adjust the interval with dash D when you start top, and it takes seconds and
tens of a second, so you can set it for like five seconds or 5.1 seconds or 10 seconds
or 10.1, the value is SS for seconds and then dot TTE for tens of a second, so you can
change that refresh interval, then there's dash N, which is the total number of iterations
that you can run.
So let's say you had a refresh, you leave it at three and you do dash N, what that will
do is it will run through, and you specify a value of 10, it'll run through 10 iterations
and 10 refreshes.
So to approximately run for about 30 seconds and then it'll quit, you could do that, I
think they said that that's a good command to do if you're running top from another application
to call information from it, running it as with a number of iterations, there's a way
to go for that, otherwise top is just going to run continuously until you press the Q key.
When you're running top and you want to adjust stuff or look at stuff in the summary section,
there's a couple of hot keys that you can press, the L key, lowercase L, we'll toggle
off and on the CPU load average section.
The T key will toggle on and off CPU states, and then the M key will toggle on and off
memory information, so those three main sections right there.
The L key will toggle off that first line right there, the load average information and
time and the up time.
The T key will toggle on and off the next two lines to see a few states and then the M key
will toggle off the last two lines, the memory information, and again recall that I had
said that if you press one key and you're in a multi-processor system, it'll open and
close, it'll show multi-processors and then it'll close the multi-processors and just
show one.
And finally, the capital I will toggle on between iris and solaris mode.
So that's the top of top, there's a lot of stuff in there to grab your brain around.
Head on over to the website, read the right up on it, if you're still confused, clarify
up especially with the different CPU percentages, what they mean, and also the difference between
iris and solaris mode.
The right up explains that then there's links in the bottom that will give you more information
on that.
The last thing I want to say about top summary section, in top in general, if you press
the H key, you will get into a little help menu and they'll talk about some of the things
that you can toggle on and off while top is running.
My name is Dan Washgo, this has been Linux in the shell, episode 13, top of top.
Thank you very much, thank Hacker Public Radio for supporting this show, we'll see you
in about two weeks for the bottom of the top, thanks a lot.
You have been listening to Hacker Public Radio, where Hacker Public Radio does our.
We are a community podcast network that releases shows every weekday on death before
Friday.
Today's show, like all our shows, was contributed by a HBR listener by yourself.
If you ever consider recording a podcast, then visit our website to find out how easy
it really is.
Hacker Public Radio was founded by the digital dot-pound and new Phenomenal and Computer
Cloud.
HBR is funded by the binary revolution at binref.com, all binref projects are crowd-responsive
by linear pages.
If you have shared hosting to custom private clouds, go to lunarpages.com for all your
hosting needs.
Unless otherwise stasis, today's show is released under a creative comments, attribution, share
a line, free those own license.