The top command is a very complex and feature-full application. When executed from the command line the top command displays two sections of information: Summary information (contained in the yellow box in the screen shot below) and running application field information (contained in the red box):

The focus of this entry will be on the Summary window of top:

The screen shot above shows the summary section. The first line contains the following information in this order by default:

• The current time
• up time
• how many users are logged in
• load average

The first three bits of information should be pretty evident. The fourth entry, load averages, if you recall, was explained in the “w” entry. The three values represent system load average over the last minute, last 5 minutes, and the last 15 minutes. Recall that this average is based on a per CPU rating. That is for a single cpu the value should not exceed 1.0. For two CPU’s the value should not exceed 2.0, and so on incrementing by a value of 1 per CPU. For a single CPU system a value of 1 means that for the past minute the load average has been at the capacity your system can handle, that is it ran at 100% performance and anything more would begin to tax the system. Generally you do not want your system running at 100% system load. Occasional spikes may occur, but if you notice your system exceeding .90 to 1.0 on a regular basis you may want to consider and upgrade for the tasks your system is attempting to perform or begin looking for culprits if this is not normal system load.

The next line lists the summary of the tasks running on the system. As depicted in the screen shot above, there are 88 total tasks. Of those tasks 1 is currently running and 87 are sleeping. There are 0 stopped and 0 zombie tasks. A stopped task or process is a process that has received a interrupt and is halted waiting to continue but has not been killed. An example would be to start a command and press ctrl-z to halt the command. The command is in a stopped state and will show as a stopped process in top. Typing:

fg %1

Will continue the process and top will no longer report the process as stopped.

A zombie process is when a running process, called the parent, spawns off another process, called the child. When the child process spawns off the parent issues a wait() call and continue to check the status of the child process. When the child process completes it releases the resources it used and remains in the process table until the parent process acknowledges the termination of the child process via the wait() command. If the parent process fails to call the wait() command to determine whether the child process has terminated the system will not be able to release the process from the process table. The child process is no longer running but is still in the process table. It is possible that the parent application is coded to leave the child process as a zombie process for a while (for instance, to force future child processes to use a different PID (process ID), or it could be a bug or poorly written parent process not acknowledged the termination of the child. Regardless, top will display the number of zombie processes currently running. (For more information on zombie processes and how to kill them, consult the references below)

The third line of top shows CPU state percentages. These values are shown per refresh interval (default is probably 3 seconds) and are as follows:

• us = time running user un-niced processes (normal user processes that have not been adjusted using nice)
• sy = system – time running kernel processes
• ni = time running user niced processes (normal user processes adjusted by the nice command)
• id = percent of time system has been idle
• wa = percent of time system has been waiting for I/O completion
• hi = percent of time servicing hardware interrupts
• si = percent of time servicing software interrupts
• st = percent of time stolen from the vm by the hypervisor.

The last entry is helpful to those running in a virtualized environment. It stands for the amount of CPU that has been allocated by the hypervisor to the virtual machine that is not being utilized by the virtual machine. This value should be 0 outside a virtualized environment. If you are in a virtual environment and see a value greater than 0 that means that some other process (probably another virtual machine) is stealing the cpu “ticks” allocated to the current VM.

If you read the man and info pages for top you will not see an entry for id which is the percent the cpu has been idle.

By default this section will show only 1 CPU. If you have multiple CPU’s you can toggle SMP view by pressing the number 1. Once turned on you can press 1 again to toggle SMP mode off. SMP has two modes Irix and Solaris. By default Irix mode is on and top displays the percentages as per each CPU. But be aware that treats each CPU with it’s own percentages. A process that consumes 10% system time would consume 10% of one CPU, not 10% of the total CPU power. Thus if totaled the sum of all time percentages would equal:

100 * n

Where n is the number of CPU’s in the system. Thus in a dual core processor system the CPU percentage in Irix mode is 200%. In Solaris mode all percentages are treated as across all CPU’s. A value of 10% would be calculated across both CPU’s. Therefore, the CPU percentage as a whole across all CPU’s would equal 100%.

The bottom two lines in the Summary window show memory information. This is the same information that was described in the entry on free. The first line will show the amount of physical memory and displays in Kilobytes (by default) the total amount of memory, total amount used, total free, and total used by buffers. Be aware of these values as they represent memory used by applications and the cache buffer used by the kernel. Do not be alarmed if the total memory reported as being used is over 2/3 your current physical memory. Remember, to get a more accurate picture you need to consult the free command an take into account the amount of memory utilized by the kernel cache.

The final summary line depicts the usage of virtual memory. This shows the total amount of swap memory allocated, how much of that swap memory is used and how much is free and how much memory is being used by the kernel cache. Very roughly speaking if you total the amount of memory being used by the buffer and the cache and subtract this from the used memory total you should get the actual amount of physical memory that is being utilized applications.

There are different ways to interact with the information in the summary window. If you press the “h” key a help window will display in top. The following keys will alter the display of the summary information:

• l = (lower case l) toggle off/on load average
• t = toggle off/on tasks and cpu states
• m = toggle off/on memory information
• 1 = toggle on/off SMP visualization
• I = (upper case i)toggle off Irix turn ON Solaris mode/toggle on Irix turn off Solaris mode (Irix on by default)

For this entry the following start-up switches are applicable:

• -d = set delay or refresh interval (default is 3 seconds). Value is in seconds and tenth’s of a second: 5, 5.5, 10.1, ss.tt
• -n = number of iterations or refresh intervals top should process before ending. By default top never ends until q is pressed.

This entry focused on the basics of the top of the top command or more accurately the summary window of the top command.
Bibliography:

• man top
• info top
• Zombie Process article on Geekride.com
• What is a zombie process? - Zombieprocess WordrPress blog
• Zombie Processes Under Linux Explained - Bright Hub Article
• Time Stolen From a Virtual Machine – Adrian Otto’s Blog
• CPU Steal Time – article on Unspoken Word
• Mean of Idle time in Top – article on IT Knowledge Exchange

If the video is not clear enough view it off the YouTube website and select size 2 or full screen.  Or download the video in Ogg Theora format:

• Episode 013 – top of top Ogg Theora Video – Archive.org

Thank you very much!

• Ogg file hosted by Hacker Public Radio
• Speex file hosted by Hacker Public Radio
• Mp3 file hosted by Hacker Public Radio