Frequently Asked Question

What is top actually showing me, and how do I read its header?

top reads /proc once per refresh interval and prints two things: a summary header and a process list. The header's CPU line, %Cpu(s): 4.3 us, 1.2 sy, 0.0 ni, 94.1 id, 0.4 wa, 0.0 hi, 0.0 si, 0.0 st, breaks down where CPU time went: us is user-space code, sy is kernel-mode, ni is "niced" (low-priority) user time, id is idle, wa is time the CPU was idle waiting for I/O to complete, hi and si are hard and soft IRQ handling, and st is time the hypervisor stole from a guest VM. A high wa means you have a disk problem, a high sy usually means too many syscalls, and a non-zero st on a cloud VM means the host is oversubscribed.

In the process list, %CPU is the percentage of one core (so 200% on a 16-core box is two cores fully busy), RES is resident memory (the bit actually in RAM), VIRT is the full address-space size (often misleadingly large), and S is the process state, R running, S sleeping, D uninterruptible sleep (usually disk wait), Z zombie. Press 1 to split per-CPU, M to sort by memory, c for full command lines, and H to show individual threads.