 | |
| Original author(s) | William LeFebvre |
|---|---|
| Initial release | 1984 |
| Written in | C |
| Operating system | Unix-like |
| Type | Process viewer / System monitor |
top (table of processes) is a task manager or system monitor program, found in many Unix-like operating systems, that displays information about CPU and memory utilization.
The program produces an ordered list of running processes selected by user-specified criteria, and updates it periodically. Default ordering is by CPU usage, and only the top CPU consumers are shown. top shows how much processing power and memory are being used, as well as other information about the running processes. Some versions of top allow extensive customization of the display, such as choice of columns or sorting method. top is useful for system administrators, as it shows which users and processes are consuming the most system resources at any given time.
There are several different versions of top. The traditional Unix version was written by William LeFebvre and originally copyrighted in 1984. [1] It is hosted on SourceForge, [2] and release 3.7 was announced in 2008. [3]
The Linux version of top is part of the procps-ng group of tools. It was originally written by Roger Binns [4] and released in early 1992 but shortly thereafter taken over by others. [5]
On Solaris, the roughly equivalent program is prstat. Microsoft Windows has the tasklist command and the graphical Task Manager utility. IBM AIX has an updating running processes list as part of the topas and topas_nmon commands.
The load average numbers in Linux refers to the sum of the number of processes waiting in the run-queue plus the number currently executing. The number is absolute, not relative. And thus it can be unbounded; unlike utilization. The instant variations of the number of processes are damped with an exponential decay formula which is calculated using fixed point math. [6]
The ps program is similar to top, but instead produces a snapshot of processes taken at the time of invocation. top's n (number of iterations) option can product a similar result, causing the program to run the specified number of iterations, then exit after printing its output.
The first 5 rows overview the entire system.
top - 14:21:23 up 2 days, 21:40, 44 users, load average: 14.44, 14.13, 14.64 | | | | <time> <system uptime> <user count> <load average for the past 1, 5, 15 minutes> Tasks: 1552 total, 8 running, 1544 sleeping, 0 stopped, 0 zombie %Cpu(s): 9.6 us, 0.7 sy, 0.0 ni, 89.5 id, 0.0 wa, 0.0 hi, 0.2 si, 0.0 st | | | | | | | '------. <user> <system> <nice> <idle> <IOWait> <hardware/software interrupt> <steal time> MiB Mem : 1031911.+total, 368915.2 free, 172285.0 used, 490711.5 buff/cache MiB Swap: 2048.0 total, 2048.0 free, 0.0 used. 807110.1 avail Mem load average is the exponential moving average of the run-queue length over the past 1/5/15 minutes. The run-queue includes both processes being run and waiting to be run. At complete utilization with no task switching, the load average is equal to the number of CPUs. [7]
Tasks counts the processes their statuses.
%Cpu(s) counts the percentage of CPU usage, broken down into categories.
MiB Mem: Memory usage in units of mebibyte. The buff/cache is for memory used by buffers and cache.
MiB Swap: Swap space usage in units of mebibyte. If the system needs more memory resources and the RAM is full, inactive pages in memory are moved to the swap space. In this snapshot, there's a total of 2048 MiB of swap, all free, indicating that no swapping is occurring, which is good for performance.
avail Mem: The amount of memory available for new applications, without swapping. This considers not just the unused RAM, but also the memory that can be reclaimed from RAM caches.
The rest of the text provides a table with each row being a process, with the following columns often used out of many possible columns (the choice and ordering of columns are configurable): [8]
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 2456 1612 1500 S 0.0 0.0 0:00.07 init(Ubuntu) 4 root 20 0 2456 4 0 S 0.0 0.0 0:00.00 init 656403 user2 20 0 80.0g 3.6g 370000 S 100.0 0.4 1594:38 python3 2024198 longnam+ 20 0 50.5g 4.7g 609200 S 1.6 0.5 204:46.85 long-name-proc 2056804 longnam+ 20 0 237.1g 31.1g 23.1g S 136.8 3.1 69:54.11 python3 PID: Process ID, a unique number identifying each running process.USER: The user who started the process. If the username is too long, it is cut-off with a + at the end.PR: Real-time priority of the task, computed by the system scheduler. Lower PR numbers are considered more important by the scheduler and more likely to be scheduled, which means it tends to have more CPU-time per real-time.NI: The niceness of the task, manually set by users and administrators to influence the real-time priority. A lower nice value tends to favor the process, and a higher nice value tends to disfavor the process. It ranges from -20 (most favored) to 19 (least favored).VIRT: Virtual memory size of the process. This includes all memory that the process can access, including memory that is swapped out, memory that is allocated but not used, and shared memory.RES: Resident set size, the portion of a process's memory that is held in RAM. Compared with VIRT, this excludes memory that is swapped out, not yet used, or shared.SHR: Shared memory size: how much of the RAM claimed by the process is sharable with other processes.S: Status of process. The status can be: R for runningS for sleepingI for idleD for disk sleep (uninterruptible)Z for zombie (terminated but not reaped by its parent)T for stopped by a job control signal or t for stopped by debugger during tracing.%CPU: The percentage of the CPU time that the process is currently using.%MEM: The percentage of the physical RAM used by the process.TIME+: The total CPU time the task has used since it started. This is shown in minutes:seconds . The plus sign in TIME+ means that it is accurate to 0.01 second. If it shows TIME then it is accurate to 1 second.COMMAND: The command line argument that started the process. Unlike USER , if the command is too long, it is cut-off without a + at the end.
In computing, multitasking is the concurrent execution of multiple tasks over a certain period of time. New tasks can interrupt already started ones before they finish, instead of waiting for them to end. As a result, a computer executes segments of multiple tasks in an interleaved manner, while the tasks share common processing resources such as central processing units (CPUs) and main memory. Multitasking automatically interrupts the running program, saving its state and loading the saved state of another program and transferring control to it. This "context switch" may be initiated at fixed time intervals, or the running program may be coded to signal to the supervisory software when it can be interrupted.
In computing, a context switch is the process of storing the state of a process or thread, so that it can be restored and resume execution at a later point, and then restoring a different, previously saved, state. This allows multiple processes to share a single central processing unit (CPU), and is an essential feature of a multiprogramming or multitasking operating system. In a traditional CPU, each process - a program in execution - utilizes the various CPU registers to store data and hold the current state of the running process. However, in a multitasking operating system, the operating system switches between processes or threads to allow the execution of multiple processes simultaneously. For every switch, the operating system must save the state of the currently running process, followed by loading the next process state, which will run on the CPU. This sequence of operations that stores the state of the running process and the loading of the following running process is called a context switch.
An operating system (OS) is system software that manages computer hardware and software resources, and provides common services for computer programs.
OS-9 is a family of real-time, process-based, multitasking, multi-user operating systems, developed in the 1980s, originally by Microware Systems Corporation for the Motorola 6809 microprocessor. It was purchased by Radisys Corp in 2001, and was purchased again in 2013 by its current owner Microware LP.
Direct memory access (DMA) is a feature of computer systems that allows certain hardware subsystems to access main system memory independently of the central processing unit (CPU).
In UNIX computing, the system load is a measure of the amount of computational work that a computer system performs. The load average represents the average system load over a period of time. It conventionally appears in the form of three numbers which represent the system load during the last one-, five-, and fifteen-minute periods.
In computer operating systems, memory paging is a memory management scheme by which a computer stores and retrieves data from secondary storage for use in main memory. In this scheme, the operating system retrieves data from secondary storage in same-size blocks called pages. Paging is an important part of virtual memory implementations in modern operating systems, using secondary storage to let programs exceed the size of available physical memory.
tmpfs is a temporary file storage paradigm implemented in many Unix-like operating systems. It is intended to appear as a mounted file system, but data is stored in volatile memory instead of a persistent storage device. A similar construction is a RAM disk, which appears as a virtual disk drive and hosts a disk file system.
In modern computers many processes run at once. Active processes are placed in an array called a run queue, or runqueue. The run queue may contain priority values for each process, which will be used by the scheduler to determine which process to run next. To ensure each program has a fair share of resources, each one is run for some time period (quantum) before it is paused and placed back into the run queue. When a program is stopped to let another run, the program with the highest priority in the run queue is then allowed to execute.
In computer science, thrashing occurs in a system with virtual memory when a computer's real storage resources are overcommitted, leading to a constant state of paging and page faults, slowing most application-level processing. This causes the performance of the computer to degrade or collapse. The situation can continue indefinitely until the user closes some running applications or the active processes free up additional virtual memory resources.
In most Unix and Unix-like operating systems, the ps program displays the currently-running processes. The related Unix utility top provides a real-time view of the running processes.
nice is a program found on Unix and Unix-like operating systems such as Linux. It directly maps to a kernel call of the same name. nice is used to invoke a utility or shell script with a particular CPU priority, thus giving the process more or less CPU time than other processes. A niceness of -20 is the lowest niceness, or highest priority. The default niceness for processes is inherited from its parent process and is usually 0.
The proc filesystem (procfs) is a special filesystem in Unix-like operating systems that presents information about processes and other system information in a hierarchical file-like structure, providing a more convenient and standardized method for dynamically accessing process data held in the kernel than traditional tracing methods or direct access to kernel memory. Typically, it is mapped to a mount point named /proc at boot time. The proc file system acts as an interface to internal data structures about running processes in the kernel. In Linux, it can also be used to obtain information about the kernel and to change certain kernel parameters at runtime (sysctl).
vmstat is a computer system monitoring tool that collects and displays summary information about operating system memory, processes, interrupts, paging and block I/O. Users of vmstat can specify a sampling interval which permits observing system activity in near-real time.
The Linux booting process involves multiple stages and is in many ways similar to the BSD and other Unix-style boot processes, from which it derives. Although the Linux booting process depends very much on the computer architecture, those architectures share similar stages and software components, including system startup, bootloader execution, loading and startup of a Linux kernel image, and execution of various startup scripts and daemons. Those are grouped into 4 steps: system startup, bootloader stage, kernel stage, and init process. When a Linux system is powered up or reset, its processor will execute a specific firmware/program for system initialization, such as Power-on self-test, invoking the reset vector to start a program at a known address in flash/ROM, then load the bootloader into RAM for later execution. In personal computer (PC), not only limited to Linux-distro PC, this firmware/program is called BIOS, which is stored in the mainboard. In embedded Linux system, this firmware/program is called boot ROM. After being loaded into RAM, bootloader will execute to load the second-stage bootloader. The second-stage bootloader will load the kernel image into memory, decompress and initialize it then pass control to this kernel image. Second-stage bootloader also performs several operation on the system such as system hardware check, mounting the root device, loading the necessary kernel modules, etc. Finally, the first user-space process starts, and other high-level system initializations are performed.
nmon is a computer performance system monitor tool for the AIX and Linux operating systems. The nmon tool has two modes a) displays the performance stats on-screen in a condensed format or b) the same stats are saved to a comma-separated values (CSV) data file for later graphing and analysis to aid the understanding of computer resource use, tuning options and bottlenecks.
Toybox is a free and open-source software implementation of over 200 Unix command line utilities such as ls, cp, and mv. The Toybox project was started in 2006, and became a 0BSD licensed BusyBox alternative. Toybox is used for most of Android's command-line tools in all currently supported Android versions, and is also used to build Android on Linux and macOS. All of the tools are tested on Linux, and many of them also work on BSD and macOS.
System Activity Report (sar) is a Unix System V-derived system monitor command used to report on various system loads, including CPU activity, memory/paging, interrupts, device load, network and swap space utilization. Sar uses /proc filesystem for gathering information.
TRESOR is a Linux kernel patch which provides encryption using only the CPU to defend against cold boot attacks on computer systems by performing encryption inside CPU registers rather than random-access memory (RAM). It is one of two proposed solutions for general-purpose computers. The other, called "frozen cache" uses the CPU cache instead. It was developed from its predecessor AESSE, presented at EuroSec 2010 and presented at USENIX Security 2011. The authors state that it allows RAM to be treated as untrusted from a security viewpoint without hindering the system.
In computer science, shared memory is memory that may be simultaneously accessed by multiple programs with an intent to provide communication among them or avoid redundant copies. Shared memory is an efficient means of passing data between programs. Depending on context, programs may run on a single processor or on multiple separate processors.
top.| File system | |
|---|---|
| Processes | |
| User environment | |
| Text processing | |
| Shell builtins | |
| Searching | |
| Documentation | |
| Software development | |
| Miscellaneous | |
| |
