the KodeLab

Linux top Command: Sort, Search, and Filter Processes Interactively

497 words 3 min read
Linux top Command: Sort, Search, and Filter Processes Interactively

On Linux, top is the quickest way to inspect running processes. Type top in a terminal and you land in an interactive mode that refreshes the process list every few seconds. The defaults are useful, but the real value is in the single-key shortcuts that let you filter and sort on the fly.

Searching and sorting

Filter by user

Press u and you will see Which user (blank for all) at the top of the screen. Type a username and press Enter to show only that user’s processes. To clear the filter, press u again and submit an empty value — the list returns to showing every user.

Filter by command

Press o and the prompt becomes add filter #1 (ignoring case) as: [!]FLD?VAL. This lets you filter by any column. For example, to show only Java processes, type:

COMMAND=java

Press Enter and the list narrows to rows whose COMMAND column contains java. Press o again to add a second filter on top of the first.

To clear all active filters at once, press =.

Sort

  • Memory usage: press uppercase M. (Lowercase m toggles how the memory summary at the top is displayed.)
  • CPU usage: press uppercase P.
  • CPU time: press uppercase T. (Lowercase t toggles how the CPU summary at the top is displayed.)
  • PID: press uppercase N.
  • Reverse the current sort: press uppercase R. For example, after pressing M to sort by memory, pressing R flips it to ascending; pressing R again flips it back.

Other controls

Moving and paging

  • One row at a time: up / down arrow keys.
  • One page at a time: < and >.

The left / right arrow keys pan horizontally, which helps when a row has more columns than fit on screen.

Opening the help

  • Option 1: run top -h in the terminal for a short usage summary.
  • Option 2: run man top for the full manual.
  • Option 3: in interactive mode, press h. Press h again to page through, and q to return to the live view.

Quitting top

In interactive mode, press q.

Aside: program vs. process

“Program” refers to the executable code on disk — one (or a set of) files that the operating system can load and run. A “process” is what you get once the operating system actually loads a program and gives it a lifecycle. One program can spawn many processes: Calculator is a single program on disk, but you can open several Calculator windows and each one is its own process.

A process owns a chunk of memory that holds its code, heap, stack, and other data. Inside a process you can spawn multiple threads, and processes can themselves fork child processes. Operating systems and programming language design courses (the kind where you learn how a language is designed, not just how to use one) go much deeper into these concepts.