How to Use Linux Top Command — Catch Who Is Eating Your

Linux Top Command: How to Catch Who Is Eating Your Server Resources

Difficulty: Beginner
Last Updated: July 2026
Tested On: Ubuntu 22.04, CentOS 7/8, Debian 12

Focus Keyword: linux top command identify resource user

Ever had your server suddenly slow to a crawl right when you needed it most? The website is unreachable, SSH hangs, and your client is blowing up your phone. You open your monitoring dashboard, see 98% CPU usage and 90% RAM, but have absolutely no idea which process is responsible. That’s the moment you realize you need to master the linux top command.

I remember the first time I had to deal with a production server that suddenly tanked. It was 2 AM, the monitoring alarm was screaming, CPU at 98%, and I had zero clue what was eating the resources. I was staring at Grafana graphs but couldn’t trace it back to any specific process. After I learned how to properly use the linux top command, everything changed. Now, whenever a server starts acting up, my first move is always the same: type top.

Think of it this way. Your server is like a shared apartment building. Inside, there are dozens of tenants (users and processes) all drawing electricity, water, and space. If the electricity bill spikes, you can’t just yell at every tenant. You need to figure out exactly who left the AC running all day or who’s running a crypto miner in their closet. The linux top command is your way of checking the meter at each apartment door.

What Is the Linux Top Command?

The linux top command is a built-in tool available on virtually every Linux distribution that displays real-time information about every running process on your server. Think of it as a terminal-based monitoring dashboard — CPU, RAM, swap usage, and a full process list, all in one screen.

When you type top in the terminal, you see a display that refreshes every few seconds. The top section shows a system resource summary, and below that is a complete list of all running processes, complete with the user who started them, CPU usage, memory consumption, and more.

What makes the linux top command so powerful is that it lets you instantly see who’s bogging down your server in real-time. No additional tools needed, no complicated setup — just type top and everything is right in front of you.

A Simple Analogy: Top Is Like a Security Camera for Your Server

Imagine that shared apartment building again. It has a security camera system that shows a dashboard of every tenant along with how much electricity, water, and space each one is using. If the electricity bill spikes, you just check the camera feed: oh, it looks like Dave left his AC running 24/7! Sarah’s running a space heater in her room all day!

That’s exactly what the linux top command does for your server. It shows you:

• Every running process — like a list of all tenants
• Which user owns each process — like the nameplate on each door
• How much resource each one uses — like a meter on each apartment
• Real-time updates — like a live security camera feed

How the Linux Top Command Works

When you run top, the program works by reading information from the /proc directory in Linux. The /proc directory is like a window into the operating system’s core — it contains all information about processes, hardware, and system status. top reads this data at regular intervals (every 3-5 seconds by default) and displays it in a human-readable format.

Each time top refreshes, it recalculates CPU percentages, memory usage, and other statistics based on the latest kernel data. This is why the display appears to “move” — because the data is continuously updating.

Reading the Linux Top Command Display

Alright, let’s break down the top display section by section. Don’t worry, I’ll explain everything with simple analogies.

Section 1: Header (System Summary)

This is the very top of the top display. Think of it like a hospital dashboard — all of your server’s vital signs are here.

top - 14:32:01 up 45 days,  3:21,  2 users,  load average: 2.15, 1.89, 1.67
Tasks: 287 total,   3 running, 284 sleeping,   0 stopped,   0 zombie
%Cpu(s): 45.3 us,  8.2 sy,  0.0 ni, 42.1 id,  3.4 wa,  0.0 hi,  1.0 si
MiB Mem :  15896.2 total,   2341.5 free,  10234.8 used,   3319.9 buff/cache
MiB Swap:   4096.0 total,   3891.2 free,    204.8 used.   5123.4 avail Mem

Let’s break it down:

Section 2: Process List (The Most Important Part!)

Below the header, there’s the list of running processes. This is the most critical part of the linux top command — this is where you identify the actual culprit.

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
   1234 www-data  20   0  892340 456780  12340 S  95.2  2.8   45:23.45 php-fpm
   5678 mysql     20   0 2345678 1234567 23456 S  78.5  7.5  123:45.67 mysqld
   9012 nobody    20   0  567890 234567   5678 S  45.3  1.4   12:34.56 nginx
   3456 root      20   0  123456  34567   2345 S  12.1  0.2    3:45.67 sshd
   7890 nobody    20   0  234567  89012   3456 S   8.7  0.5    5:23.45 nginx
   2345 root      20   0   56789  12345   1234 S   2.1  0.1    1:23.45 cron

Here’s what each important column means:

How to Use the Linux Top Command: Step by Step

Step 1: Run Top

Simply type top in the terminal:

$ top

Immediately you’ll see a real-time display that keeps updating. Every 3 seconds (default), the display refreshes with fresh data.

Step 2: Sort by CPU

To instantly see which process is eating the most CPU, press the P key (uppercase) on your keyboard:

$ top# Press P to sort by CPU usage

Now the process with the highest CPU usage appears at the top. This is the fastest way to find out who’s slowing your server down.

Step 3: Sort by Memory

Want to know who’s eating the most RAM? Press the M key (uppercase):

$ top# Press M to sort by Memory usage

The process with the highest memory usage will rise to the top.

Step 4: Filter by User

Want to see only processes from a specific user? Press u and enter the username:

$ top# Press u, then type a username, e.g.: www-data

This is super handy when you have many users on a server and want to focus on just one.

Step 5: Find a Specific Process

Looking for a specific process? Press o or O and enter a filter:

$ top# Press o then type: COMMAND=mysqld

This will display only the mysqld (MySQL server) processes.

Step 6: Show Processes for a Specific User

To show only processes belonging to a specific user, use the -u flag when running top:

$ top -u www-data

This will immediately display only processes run by user www-data.

Step 7: Kill a Problematic Process

Once you’ve identified the problematic process, press k and enter its PID:

$ top# Press k, then enter the PID to kill, e.g.: 1234

WARNING: Don’t blindly kill processes on a production server! Make sure you understand the full impact. Killing the wrong process can take down your website or cause data loss.

Simulating the Linux Top Command: What If the Server Isn’t Under Stress Yet?

Here’s the interesting part. You don’t have to wait for your server to have problems before learning the linux top command. You can simulate resource loads on a local machine or testing VPS.

Simulation 1: High CPU Load

You can create a CPU load simulation with the stress or dd command:

# Install stress (Ubuntu/Debian)
$ sudo apt install stress-ng -y

# Run stress on 1 CPU core for 30 seconds
$ stress-ng --cpu 1 --timeout 30s

# In another terminal, run top to see the load
$ top

In the second terminal, you’ll see the stress-ng process appear at the top with high CPU usage. The user will be your own user. This simulates what it looks like when a process hogs CPU.

Simulation 2: High RAM Usage

To simulate high memory usage:

# Allocate 500MB of RAM using stress-ng
$ stress-ng --vm 1 --vm-bytes 500M --timeout 30s

# In another terminal, run top
$ top

You’ll see the stress-ng process consuming a lot of RAM in the %MEM and RES columns.

Simulation 3: High I/O Wait

I/O wait happens when the CPU is ready to work but has to wait for data from the disk. Think of a cashier ready to hand over your order but the box hasn’t been unpacked yet. To simulate this:

# Write data to disk intensively
$ dd if=/dev/zero of=/tmp/testfile bs=1M count=1024 &

# In another terminal, run top
$ top

You’ll see the wa (iowait) number in the CPU header section increase. This indicates the server is waiting for disk operations to complete.

Simulation 4: Multi-User Load

For a more realistic simulation — imagine multiple users each running heavy processes:

# Run processes as different users
$ sudo -u www-data stress-ng --cpu 1 --timeout 30s &
$ sudo -u mysql stress-ng --cpu 1 --timeout 30s &
$ sudo -u nobody stress-ng --vm 1 --vm-bytes 200M --timeout 30s &

# Run top
$ top

Now in top, you’ll see multiple heavy processes from different users. This is a very realistic scenario — exactly the kind of situation where you need to identify which user is consuming the most resources.

How to Identify Which User Is Hogging Resources

Okay, here’s the part you’ve been waiting for. You already know how to read the linux top command, but how exactly do you determine which user is responsible for high CPU, RAM, or IOWait?

Method 1: Sort by the USER Column

In the top display, press F (uppercase) to enter Fields Management. Here you can select which columns to display and sort by. Choose the USER column to sort by user.

Method 2: Use Top with User Flag

If you already suspect a specific user, filter directly:

# See all processes owned by www-data
$ top -u www-data

# Or use batch mode for logging
$ top -b -n 1 -u www-data

Method 3: Use PS for Deeper Analysis

Sometimes top alone isn’t enough. You need the ps command for deeper analysis:

# See all processes with highest CPU, sorted by user
$ ps aux --sort=-%cpu | head -20

# See all processes with highest RAM
$ ps aux --sort=-%mem | head -20

# See total CPU usage per user
$ ps aux | awk '{print $1}' | sort | uniq -c | sort -rn

Method 4: Use Top in Batch Mode for Logging

If you want historical analysis (who was hogging resources earlier), use batch mode:

# Run top in batch mode, save to file
$ top -b -n 60 > /tmp/top-output.txt

# After 60 iterations (about 3 minutes), open the file
$ cat /tmp/top-output.txt | grep -E "USER|%CPU|%MEM" | head -50

Method 5: Per-User Monitoring with Atools

Linux has great tools for seeing total resource usage per user:

# Install atop (if not already installed)
$ sudo apt install atop -y

# Run atop
$ atop

atop displays more detailed information than top, including total resource usage per user over a period of time.

Troubleshooting: Why Is CPU High?

Troubleshooting: Why Is RAM Full?

Pro Tips & Warnings

alias topcpu='top -b -n 1 | head -17 | tail -10'
alias topmem='top -b -n 1 -o %MEM | head -17 | tail -10'

$ sudo apt install htop -y
$ htop

FAQ

Conclusion

Mastering the linux top command is an essential skill for anyone managing servers. Like having a security camera in your apartment — you don’t have to wait for something bad to happen before you know who’s causing problems. With top, you can:

• See in real-time who’s eating CPU, RAM, and I/O
• Identify the problematic user in seconds
• Make quick decisions: optimize, scale up, or kill the process

Starting today, make top your first move whenever a server acts up. Open the terminal, type top, press P to sort by CPU, and find the culprit. It’s that simple.

If you need a reliable VPS with resources that won’t leave you scrambling at 2 AM, consider the hosting services from syslogsolutions.net — proven stable for NOC operations and production hosting.

Related Issues

• Understanding load average on Linux
• htop vs top comparison for server monitoring
• Fixing full swap on Linux
• Disk I/O monitoring with iostat
• Fixing zombie processes on Linux