Documentation

The remaining Table of Contents

    OVERVIEW
       Operation
       Linux Memory Types
    1. COMMAND-LINE Options
    2. SUMMARY Display
       a. UPTIME and LOAD Averages
       b. TASK and CPU States
       c. MEMORY Usage
    3. FIELDS / Columns Display
       a. DESCRIPTIONS of Fields
       b. MANAGING Fields
    4. INTERACTIVE Commands
       a. GLOBAL Commands
       b. SUMMARY AREA Commands
       c. TASK AREA Commands
          1. Appearance
          2. Content
          3. Size
          4. Sorting
       d. COLOR Mapping
    5. ALTERNATE-DISPLAY Provisions
       a. WINDOWS Overview
       b. COMMANDS for Windows
       c. SCROLLING a Window
       d. SEARCHING in a Window
       e. FILTERING in a Window
    6. FILES
       a. PERSONAL Configuration File
       b. ADDING INSPECT Entries
       c. SYSTEM Configuration File
       d. SYSTEM Restrictions File
    7. ENVIRONMENT VARIABLE(S)
    8. STUPID TRICKS Sampler
       a. Kernel Magic
       b. Bouncing Windows
       c. The Big Bird Window
       d. The Ol' Switcheroo
    9. BUGS, 10. SEE Also

Operation

When operating top, the two most important keys are the help (h or ?) key and quit (`q') key. Alternatively, you could simply use the traditional interrupt key (^C) when you're done.

When started for the first time, you'll be presented with these traditional elements on the main top screen: 1) Summary Area; 2) Fields/Columns Header; 3) Task Area. Each of these will be explored in the sections that follow. There is also an Input/Message line between the Summary Area and Columns Header which needs no further explanation.

The main top screen is generally quite adaptive to changes in terminal dimensions under X-Windows. Other top screens may be less so, especially those with static text. It ultimately depends, however, on your particular window manager and terminal emulator. There may be occasions when their view of terminal size and current contents differs from top's view, which is always based on operating system calls.

Following any re-size operation, if a top screen is corrupted, appears incomplete or disordered, simply typing something innocuous like a punctuation character or cursor motion key will usually restore it. In extreme cases, the following sequence almost certainly will:

       key/cmd  objective 
       ^Z       suspend top
       fg       resume top
       <Left>   force a screen redraw (if necessary)

But if the display is still corrupted, there is one more step you could try. Insert this command after top has been suspended but before resuming it.

       key/cmd  objective 
       reset    restore your terminal settings

Note: the width of top's display will be limited to 512 positions. Displaying all fields requires approximately 250 characters. Remaining screen width is usually allocated to any variable width columns currently visible. The variable width columns, such as COMMAND, are noted in topic 3a. DESCRIPTIONS of Fields. Actual output width may also be influenced by the -w switch, which is discussed in topic 1. COMMAND-LINE Options.

Lastly, some of top's screens or functions require the use of cursor motion keys like the standard arrow keys plus the Home, End, PgUp and PgDn keys. If your terminal or emulator does not provide those keys, the following combinations are accepted as alternatives:

       key      equivalent-keys 
       Left     alt + h 
       Down     alt + j 
       Up       alt + k 
       Right    alt + l 
       Home     alt + ctrl + h 
       PgDn     alt + ctrl + j 
       PgUp     alt + ctrl + k 
       End      alt + ctrl + l 

The Up and Down arrow keys have special significance when prompted for line input terminated with the <Enter> key. Those keys, or their aliases, can be used to retrieve previous input lines which can then be edited and re-input. And there are four additional keys available with line oriented input.

       key      special-significance 
       Up       recall older strings for re-editing
       Down     recall newer strings or erase entire line
       Insert   toggle between insert and overtype modes
       Delete   character removed at cursor, moving others left
       Home     jump to beginning of input line
       End      jump to end of input line

Linux Memory Types

For our purposes there are three types of memory, and one is optional. First is physical memory, a limited resource where code and data must reside when executed or referenced. Next is the optional swap file, where modified (dirty) memory can be saved and later retrieved if too many demands are made on physical memory. Lastly we have virtual memory, a nearly unlimited resource serving the following goals:

   1. abstraction, free from physical memory addresses/limits
   2. isolation, every process in a separate address space
   3. sharing, a single mapping can serve multiple needs
   4. flexibility, assign a virtual address to a file

Regardless of which of these forms memory may take, all are managed as pages (typically 4096 bytes) but expressed by default in top as KiB (kibibyte). The memory discussed under topic `2c. MEMORY Usage' deals with physical memory and the swap file for the system as a whole. The memory reviewed in topic `3. FIELDS / Columns Display' embraces all three memory types, but for individual processes.

For each such process, every memory page is restricted to a single quadrant from the table below. Both physical memory and virtual memory can include any of the four, while the swap file only includes #1 through #3. The memory in quadrant #4, when modified, acts as its own dedicated swap file.

                              Private | Shared
                          1           |          2
     Anonymous  . stack               |
                . malloc()            |
                . brk()/sbrk()        | . POSIX shm*
                . mmap(PRIVATE, ANON) | . mmap(SHARED, ANON)
               -----------------------+----------------------
                . mmap(PRIVATE, fd)   | . mmap(SHARED, fd)
   File-backed  . pgms/shared libs    |
                          3           |          4

The following may help in interpreting process level memory values displayed as scalable columns and discussed under topic `3a. DESCRIPTIONS of Fields'.

   %MEM - simply RES divided by total physical memory
   CODE - the `pgms' portion of quadrant 3
   DATA - the entire quadrant 1 portion of VIRT plus all
          explicit mmap file-backed pages of quadrant 3
   RES  - anything occupying physical memory which, beginning with
          Linux-4.5, is the sum of the following three fields:
          RSan - quadrant 1 pages, which include any
                 former quadrant 3 pages if modified
          RSfd - quadrant 3 and quadrant 4 pages
          RSsh - quadrant 2 pages
   RSlk - subset of RES which cannot be swapped out (any quadrant)
   SHR  - subset of RES (excludes 1, includes all 2 & 4, some 3)
   SWAP - potentially any quadrant except 4
   USED - simply the sum of RES and SWAP
   VIRT - everything in-use and/or reserved (all quadrants)

Note: Even though program images and shared libraries are considered private to a process, they will be accounted for as shared (SHR) by the kernel.

2a. UPTIME and LOAD Averages

This portion consists of a single line containing:

    program or window name, depending on display mode
    current time and length of time since last boot
    total number of users
    system load avg over the last 1, 5 and 15 minutes

2b. TASK and CPU States

This portion consists of a minimum of two lines. In an SMP environment, additional lines can reflect individual CPU state percentages.

Line 1 shows total tasks or threads, depending on the state of the Threads-mode toggle. That total is further classified as:

    running; sleeping; stopped; zombie

Line 2 shows CPU state percentages based on the interval since the last refresh.

As a default, percentages for these individual categories are displayed. Depending on your kernel version, the st field may not be shown.

    us : time running un-niced user processes
    sy : time running kernel processes
    ni : time running niced user processes
    id : time spent in the kernel idle handler
    wa : time waiting for I/O completion
    hi : time spent servicing hardware interrupts
    si : time spent servicing software interrupts
    st : time stolen from this vm by the hypervisor

The `sy' value above also reflects the time running a virtual cpu for guest operating systems, including those that have been niced.

Beyond the first tasks/threads line, there are alternate CPU display modes available via the 4-way `t' command toggle. They show an abbreviated summary consisting of these elements:

               a    b     c    d
    %Cpu(s):  75.0/25.0  100[ ... ]

Where: a) is the `user' (us + ni) percentage; b) is the `system' (sy + hi + si + guests) percentage; c) is the total percentage; and d) is one of two visual graphs of those representations. Such graphs also reflect separate `user' and `system' portions.

If the `4' command toggle is used to yield more than two cpus per line, results will be further abridged eliminating the a) and b) elements. However, that information is still reflected in the graph itself assuming color is active or, if not, bars vs. blocks are being shown.

See topic 4b. SUMMARY AREA Commands for additional information on the `t' and `4' command toggles.

2c. MEMORY Usage

This portion consists of two lines which may express values in kibibytes (KiB) through exbibytes (EiB) depending on the scaling factor enforced with the `E' interactive command. The /proc/meminfo source fields are shown in parenthesis.

Line 1 reflects physical memory, classified as:

    total          ( MemTotal )
    free           ( MemFree )
    used           ( MemTotal - MemAvailable )
    buff/cache     ( Buffers + Cached + SReclaimable )

Line 2 reflects mostly virtual memory, classified as:

    total          ( SwapTotal )
    free           ( SwapFree )
    used           ( SwapTotal - SwapFree )
    avail          ( MemAvailable, which is physical memory )

The avail number on line 2 is an estimation of physical memory available for starting new applications, without swapping. Unlike the free field, it attempts to account for readily reclaimable page cache and memory slabs. It is available on kernels 3.14, emulated on kernels 2.6.27+, otherwise the same as free.

In the alternate memory display modes, two abbreviated summary lines are shown consisting of these elements:

               a    b          c
    GiB Mem : 18.7/15.738   [ ... ]
    GiB Swap:  0.0/7.999    [ ... ]

Where: a) is the percentage used; b) is the total available; and c) is one of two visual graphs of those representations.

In the case of physical memory, the percentage represents the total minus the estimated avail noted above. The `Mem' graph itself is divided between the non-cached portion of used and any remaining memory not otherwise accounted for by avail. See topic 4b. SUMMARY AREA Commands and the `m' command for additional information on that special 4-way toggle.

This table may help in interpreting the scaled values displayed:

    KiB = kibibyte = 1024 bytes
    MiB = mebibyte = 1024 KiB = 1,048,576 bytes
    GiB = gibibyte = 1024 MiB = 1,073,741,824 bytes
    TiB = tebibyte = 1024 GiB = 1,099,511,627,776 bytes
    PiB = pebibyte = 1024 TiB = 1,125,899,906,842,624 bytes
    EiB = exbibyte = 1024 PiB = 1,152,921,504,606,846,976 bytes

3a. DESCRIPTIONS of Fields

Listed below are top's available process fields (columns). They are shown in strict ascii alphabetical order. You may customize their position and whether or not they are displayable with the `f' (Fields Management) interactive command.

Any field is selectable as the sort field, and you control whether they are sorted high-to-low or low-to-high. For additional information on sort provisions see topic 4c. TASK AREA Commands, SORTING.

The fields related to physical memory or virtual memory reference `(KiB)' which is the unsuffixed display mode. Such fields may, however, be scaled from KiB through PiB. That scaling is influenced via the `e' interactive command or established for startup through a build option.

%CPU  --  CPU Usage

The task's share of the elapsed CPU time since the last screen update, expressed as a percentage of total CPU time.

In a true SMP environment, if a process is multi-threaded and top is not operating in Threads mode, amounts greater than 100% may be reported. You toggle Threads mode with the `H' interactive command.

Also for multi-processor environments, if Irix mode is Off, top will operate in Solaris mode where a task's cpu usage will be divided by the total number of CPUs. You toggle Irix/Solaris modes with the `I' interactive command.

Note: When running in forest view mode (`V') with children collapsed (`v'), this field will also include the CPU time of those unseen children. See topic 4c. TASK AREA Commands, CONTENT for more information regarding the `V' and `v' toggles.

%CUC  --  CPU Utilization

This field is identical to %CUU below, except the percentage also reflects reaped child processes.

%CUU  --  CPU Utilization

A task's total CPU usage divided by its elapsed running time, expressed as a percentage.

If a process currently displays high CPU usage, this field can help determine if such behavior is normal. Conversely, if a process has low CPU usage currently, %CUU may reflect historically higher demands over its lifetime.

%MEM  --  Memory Usage (RES)

A task's currently resident share of available physical memory.

See `OVERVIEW, Linux Memory Types' for additional details.

AGID  --  Autogroup Identifier

The autogroup identifier associated with a process. This feature operates in conjunction with the CFS scheduler to improve interactive desktop performance.

When /proc/sys/kernel/sched_autogroup_enabled is set, a new autogroup is created with each new session (see SID). All subsequently forked processes in that session inherit membership in this autogroup. The kernel then attempts to equalize distribution of CPU cycles across such groups. Thus, an autogroup with many CPU intensive processes (e.g make -j) will not dominate an autogroup with only one or two processes.

When -1 is displayed it means this information is not available.

AGNI  --  Autogroup Nice Value

The autogroup nice value which affects scheduling of all processes in that group. A negative nice value means higher priority, whereas a positive nice value means lower priority.

CGNAME  --  Control Group Name

The name of the control group to which a process belongs, or `-' if not applicable for that process.

This will typically be the last entry in the full list of control groups as shown under the next heading (CGROUPS). And as is true there, this field is also variable width.

CGROUPS  --  Control Groups

The names of the control group(s) to which a process belongs, or `-' if not applicable for that process.

Control Groups provide for allocating resources (cpu, memory, network bandwidth, etc.) among installation-defined groups of processes. They enable fine-grained control over allocating, denying, prioritizing, managing and monitoring those resources.

Many different hierarchies of cgroups can exist simultaneously on a system and each hierarchy is attached to one or more subsystems. A subsystem represents a single resource.

Note: The CGROUPS field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters). Even so, such variable width fields could still suffer truncation. See topic 5c. SCROLLING a Window for additional information on accessing any truncated data.

CODE  --  Code Size (KiB)

The amount of physical memory currently devoted to executable code, also known as the Text Resident Set size or TRS.

See `OVERVIEW, Linux Memory Types' for additional details.

COMMAND  --  Command Name or Command Line

Display the command line used to start a task or the name of the associated program. You toggle between command line and name with `c', which is both a command-line option and an interactive command.

When you've chosen to display command lines, processes without a command line (like kernel threads) will be shown with only the program name in brackets, as in this example:
[kthreadd]

This field may also be impacted by the forest view display mode. See the `V' interactive command for additional information regarding that mode.

Note: The COMMAND field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters). Even so, such variable width fields could still suffer truncation. This is especially true for this field when command lines are being displayed (the `c' interactive command.) See topic 5c. SCROLLING a Window for additional information on accessing any truncated data.

DATA  --  Data + Stack Size (KiB)

The amount of private memory reserved by a process. It is also known as the Data Resident Set or DRS. Such memory may not yet be mapped to physical memory (RES) but will always be included in the virtual memory (VIRT) amount.

See `OVERVIEW, Linux Memory Types' for additional details.

ELAPSED  --  Elapsed Running Time

The length of time since a process was started. Thus, the most recently started task will display the smallest time interval.

The value will be expressed as `HH,MM' (hours,minutes) but is subject to additional scaling if the interval becomes too great to fit column width. At that point it will be scaled to `DD+HH' (days+hours) and possibly beyond.

ENVIRON  --  Environment variables

Display all of the environment variables, if any, as seen by the respective processes. These variables will be displayed in their raw native order, not the sorted order you are accustomed to seeing with an unqualified `set'.

Note: The ENVIRON field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters). Even so, such variable width fields could still suffer truncation. This is especially true for this field. See topic 5c. SCROLLING a Window for additional information on accessing any truncated data.

EXE  --  Executable Path

Where available, this is the full path to the executable, including the program name.

Note: The EXE field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters).

Flags  --  Task Flags

This column represents the task's current scheduling flags which are expressed in hexadecimal notation and with zeros suppressed. These flags are officially documented in <linux/sched.h>.

GID  --  Group Id

The effective group ID.

GROUP  --  Group Name

The effective group name.

LOGID  --  Login User Id

The user ID used at login. When -1 is displayed it means this information is not available.

LXC  --  Lxc Container Name

The name of the lxc container within which a task is running. If a process is not running inside a container, a dash (`-') will be shown.

NI  --  Nice Value

The nice value of the task. A negative nice value means higher priority, whereas a positive nice value means lower priority. Zero in this field simply means priority will not be adjusted in determining a task's dispatch-ability.

Note: This value only affects scheduling priority relative to other processes in the same autogroup. See the `AGID' and `AGNI' fields for additional information on autogroups.

NU  --  Last known NUMA node

A number representing the NUMA node associated with the last used processor (`P'). When -1 is displayed it means that NUMA information is not available.

See the `2' and `3' interactive commands for additional NUMA provisions affecting the summary area.

OOMa  --  Out of Memory Adjustment Factor

The value, ranging from -1000 to +1000, added to the current out of memory score (OOMs) which is then used to determine which task to kill when memory is exhausted.

OOMs  --  Out of Memory Score

The value, ranging from 0 to +1000, used to select task(s) to kill when memory is exhausted. Zero translates to `never kill' whereas 1000 means `always kill'.

P  --  Last used CPU (SMP)

A number representing the last used processor. In a true SMP environment this will likely change frequently since the kernel intentionally uses weak affinity. Also, the very act of running top may break this weak affinity and cause more processes to change CPUs more often (because of the extra demand for cpu time).

PGRP  --  Process Group Id

Every process is member of a unique process group which is used for distribution of signals and by terminals to arbitrate requests for their input and output. When a process is created (forked), it becomes a member of the process group of its parent. By convention, this value equals the process ID (see PID) of the first member of a process group, called the process group leader.

PID  --  Process Id

The task's unique process ID, which periodically wraps, though never restarting at zero. In kernel terms, it is a dispatchable entity defined by a task_struct.

This value may also be used as: a process group ID (see PGRP); a session ID for the session leader (see SID); a thread group ID for the thread group leader (see TGID); and a TTY process group ID for the process group leader (see TPGID).

PPID  --  Parent Process Id

The process ID (pid) of a task's parent.

PR  --  Priority

The scheduling priority of the task. If you see `rt' in this field, it means the task is running under real time scheduling priority.

Under linux, real time priority is somewhat misleading since traditionally the operating itself was not preemptible. And while the 2.6 kernel can be made mostly preemptible, it is not always so.

PSS  --  Proportional Resident Memory, smaps (KiB)

The proportion of this task's share of `RSS' where each page is divided by the number of processes sharing it. It is also the sum of the `PSan', `PSfd' and `PSsh' fields.

For example, if a process has 1000 resident pages alone and 1000 resident pages shared with another process, its `PSS' would be 1500 (times page size).

Accessing smaps values is 10x more costly than other memory statistics and data for other users requires root privileges.

PSan  --  Proportional Anonymous Memory, smaps (KiB)
PSfd  --  Proportional File Memory, smaps (KiB)
PSsh  --  Proportional Shmem Memory, smaps (KiB)

RES  --  Resident Memory Size (KiB)

A subset of the virtual address space (VIRT) representing the non-swapped physical memory a task is currently using. It is also the sum of the `RSan', `RSfd' and `RSsh' fields.

It can include private anonymous pages, private pages mapped to files (including program images and shared libraries) plus shared anonymous pages. All such memory is backed by the swap file represented separately under SWAP.

Lastly, this field may also include shared file-backed pages which, when modified, act as a dedicated swap file and thus will never impact SWAP.

See `OVERVIEW, Linux Memory Types' for additional details.

RSS  --  Resident Memory, smaps (KiB)

Another, more precise view of process non-swapped physical memory. It is obtained from the `smaps_rollup' file and is generally slightly larger than that shown for `RES'.

Accessing smaps values is 10x more costly than other memory statistics and data for other users requires root privileges.

RSan  --  Resident Anonymous Memory Size (KiB)

A subset of resident memory (RES) representing private pages not mapped to a file.

RSfd  --  Resident File-Backed Memory Size (KiB)

A subset of resident memory (RES) representing the implicitly shared pages supporting program images and shared libraries. It also includes explicit file mappings, both private and shared.

RSlk  --  Resident Locked Memory Size (KiB)

A subset of resident memory (RES) which cannot be swapped out.

RSsh  --  Resident Shared Memory Size (KiB)

A subset of resident memory (RES) representing the explicitly shared anonymous shm*/mmap pages.

RUID  --  Real User Id

The real user ID.

RUSER  --  Real User Name

The real user name.

S  --  Process Status

The status of the task which can be one of:
D = uninterruptible sleep
I = idle
R = running
S = sleeping
T = stopped by job control signal
t = stopped by debugger during trace
Z = zombie

Tasks shown as running should be more properly thought of as ready to run  --  their task_struct is simply represented on the Linux run-queue. Even without a true SMP machine, you may see numerous tasks in this state depending on top's delay interval and nice value.

SHR  --  Shared Memory Size (KiB)

A subset of resident memory (RES) that may be used by other processes. It will include shared anonymous pages and shared file-backed pages. It also includes private pages mapped to files representing program images and shared libraries.

See `OVERVIEW, Linux Memory Types' for additional details.

SID  --  Session Id

A session is a collection of process groups (see PGRP), usually established by the login shell. A newly forked process joins the session of its creator. By convention, this value equals the process ID (see PID) of the first member of the session, called the session leader, which is usually the login shell.

STARTED  --  Start Time Interval

The length of time since system boot when a process started. Thus, the most recently started task will display the largest time interval.

The value will be expressed as `MM:SS' (minutes:seconds). But if the interval is too great to fit column width it will be scaled as `HH,MM' (hours,minutes) and possibly beyond.

SUID  --  Saved User Id

The saved user ID.

SUPGIDS  --  Supplementary Group IDs

The IDs of any supplementary group(s) established at login or inherited from a task's parent. They are displayed in a comma delimited list.

Note: The SUPGIDS field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters).

SUPGRPS  --  Supplementary Group Names

The names of any supplementary group(s) established at login or inherited from a task's parent. They are displayed in a comma delimited list.

Note: The SUPGRPS field, unlike most columns, is not fixed-width. When displayed, it plus any other variable width columns will be allocated all remaining screen width (up to the maximum 512 characters).

SUSER  --  Saved User Name

The saved user name.

SWAP  --  Swapped Size (KiB)

The formerly resident portion of a task's address space written to the swap file when physical memory becomes over committed.

See `OVERVIEW, Linux Memory Types' for additional details.

TGID  --  Thread Group Id

The ID of the thread group to which a task belongs. It is the PID of the thread group leader. In kernel terms, it represents those tasks that share an mm_struct.

TIME  --  CPU Time

Total CPU time the task has used since it started. When Cumulative mode is On, each process is listed with the cpu time that it and its dead children have used. You toggle Cumulative mode with `S', which is both a command-line option and an interactive command. See the `S' interactive command for additional information regarding this mode.

TIME+  --  CPU Time, hundredths

The same as TIME, but reflecting more granularity through hundredths of a second.

TPGID  --  Tty Process Group Id

The process group ID of the foreground process for the connected tty, or -1 if a process is not connected to a terminal. By convention, this value equals the process ID (see PID) of the process group leader (see PGRP).

TTY  --  Controlling Tty

The name of the controlling terminal. This is usually the device (serial port, pty, etc.) from which the process was started, and which it uses for input or output. However, a task need not be associated with a terminal, in which case you'll see `?' displayed.

UID  --  User Id

The effective user ID of the task's owner.

USED  --  Memory in Use (KiB)

This field represents the non-swapped physical memory a task is using (RES) plus the swapped out portion of its address space (SWAP).

See `OVERVIEW, Linux Memory Types' for additional details.

USER  --  User Name

The effective user name of the task's owner.

USS  --  Unique Set Size

The non-swapped portion of physical memory (`RSS') not shared with any other process. It is derived from the `smaps_rollup' file.

Accessing smaps values is 10x more costly than other memory statistics and data for other users requires root privileges.

VIRT  --  Virtual Memory Size (KiB)

The total amount of virtual memory used by the task. It includes all code, data and shared libraries plus pages that have been swapped out and pages that have been mapped but not used.

See `OVERVIEW, Linux Memory Types' for additional details.

WCHAN  --  Sleeping in Function

This field will show the name of the kernel function in which the task is currently sleeping. Running tasks will display a dash (`-') in this column.

ioR  --  I/O Bytes Read

The number of bytes a process caused to be fetched from the storage layer.

Root privileges are required to display `io' data for other users.

ioRop  --  I/O Read Operations

The number of read I/O operations (syscalls) for a process. Such calls might not result in actual physical disk I/O.

ioW  --  I/O Bytes Written

The number of bytes a process caused to be sent to the storage layer.

ioWop  --  I/O Write Operations

The number of write I/O operations (syscalls) for a process. Such calls might not result in actual physical disk I/O.

nDRT  --  Dirty Pages Count

The number of pages that have been modified since they were last written to auxiliary storage. Dirty pages must be written to auxiliary storage before the corresponding physical memory location can be used for some other virtual page.

This field was deprecated with linux 2.6 and is always zero.

nMaj  --  Major Page Fault Count

The number of major page faults that have occurred for a task. A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space. A major page fault is when auxiliary storage access is involved in making that page available.

nMin  --  Minor Page Fault count

The number of minor page faults that have occurred for a task. A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space. A minor page fault does not involve auxiliary storage access in making that page available.

nTH  --  Number of Threads

The number of threads associated with a process.

nsCGROUP  --  CGROUP namespace

The Inode of the namespace used to hide the identity of the control group of which process is a member.

nsIPC  --  IPC namespace

The Inode of the namespace used to isolate interprocess communication (IPC) resources such as System V IPC objects and POSIX message queues.

nsMNT  --  MNT namespace

The Inode of the namespace used to isolate filesystem mount points thus offering different views of the filesystem hierarchy.

nsNET  --  NET namespace

The Inode of the namespace used to isolate resources such as network devices, IP addresses, IP routing, port numbers, etc.

nsPID  --  PID namespace

The Inode of the namespace used to isolate process ID numbers meaning they need not remain unique. Thus, each such namespace could have its own `init/systemd' (PID #1) to manage various initialization tasks and reap orphaned child processes.

nsTIME  --  TIME namespace

The Inode of the namespace which allows processes to see different system times in a way similar to the UTS namespace.

nsUSER  --  USER namespace

The Inode of the namespace used to isolate the user and group ID numbers. Thus, a process could have a normal unprivileged user ID outside a user namespace while having a user ID of 0, with full root privileges, inside that namespace.

nsUTS  --  UTS namespace

The Inode of the namespace used to isolate hostname and NIS domain name. UTS simply means "UNIX Time-sharing System".

vMj  --  Major Page Fault Count Delta

The number of major page faults that have occurred since the last update (see nMaj).

vMn  --  Minor Page Fault Count Delta

The number of minor page faults that have occurred since the last update (see nMin).

3b. MANAGING Fields

After pressing the interactive command `f' (Fields Management) you will be presented with a screen showing: 1) the `current' window name; 2) the designated sort field; 3) all fields in their current order along with descriptions. Entries marked with an asterisk are the currently displayed fields, screen width permitting.

4a. GLOBAL Commands

The global interactive commands are always available in both full-screen mode and alternate-display mode. However, some of these interactive commands are not available when running in Secure mode.

If you wish to know in advance whether or not your top has been secured, simply ask for help and view the system summary on the second line.

  <Enter> or <Space>  :Refresh-Display

These commands awaken top and following receipt of any input the entire display will be repainted. They also force an update of any hotplugged cpu or physical memory changes.

Use either of these keys if you have a large delay interval and wish to see current status,

   ? | h  :Help

There are two help levels available. The first will provide a reminder of all the basic interactive commands. If top is secured, that screen will be abbreviated.

Typing `h' or `?' on that help screen will take you to help for those interactive commands applicable to alternate-display mode.

   =  :Exit-Display-Limits

Removes restrictions on what is shown. This command will reverse any `i' (idle tasks), `n' (max tasks), `v' (hide children) and `F' focus commands that might be active. It also provides for an exit from PID monitoring, User filtering, Other filtering, Locate processing and Combine Cpus mode.

Additionally, if the window has been scrolled it will be reset with this command.

   0  :Zero-Suppress toggle

This command determines whether zeros are shown or suppressed for many of the fields in a task window. Fields like UID, GID, NI, PR or P are not affected by this toggle.

   A  :Alternate-Display-Mode toggle

This command will switch between full-screen mode and alternate-display mode. See topic 5. ALTERNATE-DISPLAY Provisions and the `g' interactive command for insight into `current' windows and field groups.

   B  :Bold-Disable/Enable toggle

This command will influence use of the bold terminfo capability and alters both the summary area and task area for the `current' window. While it is intended primarily for use with dumb terminals, it can be applied anytime.

Note: When this toggle is On and top is operating in monochrome mode, the entire display will appear as normal text. Thus, unless the `x' and/or `y' toggles are using reverse for emphasis, there will be no visual confirmation that they are even on.

*  d | s  :Change-Delay-Time-interval

You will be prompted to enter the delay time, in seconds, between display updates.

Fractional seconds are honored, but a negative number is not allowed. Entering 0 causes (nearly) continuous updates, with an unsatisfactory display as the system and tty driver try to keep up with top's demands. The delay value is inversely proportional to system loading, so set it with care.

If at any time you wish to know the current delay time, simply ask for help and view the system summary on the second line.

   E  :Enforce-Summary-Memory-Scale in Summary Area

With this command you can cycle through the available summary area memory scaling which ranges from KiB (kibibytes or 1,024 bytes) through EiB (exbibytes or 1,152,921,504,606,846,976 bytes).

If you see a `+' between a displayed number and the following label, it means that top was forced to truncate some portion of that number. By raising the scaling factor, such truncation can be avoided.

   e  :Enforce-Task-Memory-Scale in Task Area

With this command you can cycle through the available task area memory scaling which ranges from KiB (kibibytes or 1,024 bytes) through PiB (pebibytes or 1,125,899,906,842,624 bytes).

While top will try to honor the selected target range, additional scaling might still be necessary in order to accommodate current values. If you wish to see a more homogeneous result in the memory columns, raising the scaling range will usually accomplish that goal. Raising it too high, however, is likely to produce an all zero result which cannot be suppressed with the `0' interactive command.

   g  :Choose-Another-Window/Field-Group

You will be prompted to enter a number between 1 and 4 designating the field group which should be made the `current' window. You will soon grow comfortable with these 4 windows, especially after experimenting with alternate-display mode.

   H  :Threads-mode toggle

When this toggle is On, individual threads will be displayed for all processes in all visible task windows. Otherwise, top displays a summation of all threads in each process.

   I  :Irix/Solaris-Mode toggle

When operating in Solaris mode (`I' toggled Off), a task's cpu usage will be divided by the total number of CPUs. After issuing this command, you'll be told the new state of this toggle.

*  k  :Kill-a-task

You will be prompted for a PID and then the signal to send.

Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself.

The default signal, as reflected in the prompt, is SIGTERM. However, you can send any signal, via number or name.

If you wish to abort the kill process, do one of the following depending on your progress:

    1) at the pid prompt, type an invalid number
    2) at the signal prompt, type 0 (or any invalid signal)
    3) at any prompt, type <Esc>

   q  :Quit

*  r  :Renice-a-Task

You will be prompted for a PID and then the value to nice it to.

Entering no PID or a negative number will be interpreted as the default shown in the prompt (the first task displayed). A PID value of zero means the top program itself.

A positive nice value will cause a process to lose priority. Conversely, a negative nice value will cause a process to be viewed more favorably by the kernel. As a general rule, ordinary users can only increase the nice value and are prevented from lowering it.

If you wish to abort the renice process, do one of the following depending on your progress:

    1) at the pid prompt, type an invalid number
    2) at the nice prompt, type <Enter> with no input
    3) at any prompt, type <Esc>

   W  :Write-the-Configuration-File

This will save all of your options and toggles plus the current display mode and delay time. By issuing this command just before quitting top, you will be able restart later in exactly that same state.

   X  :Extra-Fixed-Width

Some fields are fixed width and not scalable. As such, they are subject to truncation which would be indicated by a `+' in the last position.

This interactive command can be used to alter the widths of the following fields:

    field  default    field  default    field   default 
    GID       5       GROUP     8       WCHAN      10
    LOGID     5       LXC       8       nsCGROUP   10
    RUID      5       RUSER     8       nsIPC      10
    SUID      5       SUSER     8       nsMNT      10
    UID       5       TTY       8       nsNET      10
                      USER      8       nsPID      10
                                        nsTIME     10
                                        nsUSER     10
                                        nsUTS      10

You will be prompted for the amount to be added to the default widths shown above. Entering zero forces a return to those defaults.

If you enter a negative number, top will automatically increase the column size as needed until there is no more truncated data.

Note: Whether explicitly or automatically increased, the widths for these fields are never decreased by top. To narrow them you must specify a smaller number or restore the defaults.

   Y  :Inspect-Other-Output

After issuing the `Y' interactive command, you will be prompted for a target PID. Typing a value or accepting the default results in a separate screen. That screen can be used to view a variety of files or piped command output while the normal top iterative display is paused.

Note: This interactive command is only fully realized when supporting entries have been manually added to the end of the top configuration file. For details on creating those entries, see topic 6b. ADDING INSPECT Entries.

Most of the keys used to navigate the Inspect feature are reflected in its header prologue. There are, however, additional keys available once you have selected a particular file or command. They are familiar to anyone who has used the pager `less' and are summarized here for future reference.

    key      function 
    =        alternate status-line, file or pipeline
    /        find, equivalent to `L' locate
    n        find next, equivalent to `&' locate next
    <Space>  scroll down, equivalent to <PgDn>
    b        scroll up, equivalent to <PgUp>
    g        first line, equivalent to <Home>
    G        last line, equivalent to <End>

   Z  :Change-Color-Mapping

This key will take you to a separate screen where you can change the colors for the `current' window, or for all windows. For details regarding this interactive command see topic 4d. COLOR Mapping.

  ^G  :Display-Control-Groups (Ctrl key + `g')
  ^K  :Display-Cmdline (Ctrl key + `k')
  ^N  :Display-Environment (Ctrl key + `n')
  ^P  :Display-Namesspaces (Ctrl key + `p')
  ^U  :Display-Supplementary-Groups (Ctrl key + `u')

    pipe ^I Environment ^I cat /proc/%d/environ | tr '\0' '\n'

4b. SUMMARY AREA Commands

The summary area interactive commands are always available in both full-screen mode and alternate-display mode. They affect the beginning lines of your display and will determine the position of messages and prompts.

These commands always impact just the `current' window/field group. See topic 5. ALTERNATE-DISPLAY Provisions and the `g' interactive command for insight into `current' windows and field groups.

   C  :Show-scroll-coordinates toggle

Toggle an informational message which is displayed whenever the message line is not otherwise being used. For additional information see topic 5c. SCROLLING a Window.

   l  :Load-Average/Uptime toggle

This is also the line containing the program name (possibly an alias) when operating in full-screen mode or the `current' window name when operating in alternate-display mode.

   t  :Task/Cpu-States toggle

This command affects from 2 to many summary area lines, depending on the state of the `1', `2' or `3' command toggles and whether or not top is running under true SMP.

This portion of the summary area is also influenced by the `H' interactive command toggle, as reflected in the total label which shows either Tasks or Threads.

This command serves as a 4-way toggle, cycling through these modes:

    1. detailed percentages by category
    2. abbreviated user/system and total % + bar graph
    3. abbreviated user/system and total % + block graph
    4. turn off task and cpu states display

When operating in either of the graphic modes, the display becomes much more meaningful when individual CPUs or NUMA nodes are also displayed. See the the `1', `2' and `3' commands below for additional information.

   m  :Memory/Swap-Usage toggle

This command affects the two summary area lines dealing with physical and virtual memory.

This command serves as a 4-way toggle, cycling through these modes:

    1. detailed percentages by memory type
    2. abbreviated % used/total available + bar graph
    3. abbreviated % used/total available + block graph
    4. turn off memory display

   1  :Single/Separate-Cpu-States toggle

This command affects how the `t' command's Cpu States portion is shown. Although this toggle exists primarily to serve massively-parallel SMP machines, it is not restricted to solely SMP environments.

When you see `%Cpu(s):' in the summary area, the `1' toggle is On and all cpu information is gathered in a single line. Otherwise, each cpu is displayed separately as: `%Cpu0, %Cpu1, ...' up to available screen height.

   2  :NUMA-Nodes/Cpu-Summary toggle

This command toggles between the `1' command cpu summary display (only) or a summary display plus the cpu usage statistics for each NUMA Node. It is only available if a system has the requisite NUMA support.

   3  :Expand-NUMA-Node

You will be invited to enter a number representing a NUMA Node. Thereafter, a node summary plus the statistics for each cpu in that node will be shown until the `1', `2' or `4' command toggle is pressed. This interactive command is only available if a system has the requisite NUMA support.

   4  :Display-Multiple-Elements-Adjacent toggle

This command toggle turns the `1' toggle Off and shows multiple CPU and Memory results on each line. Each successive `4' key adds another CPU until again reverting to separate lines for CPU and Memory results.

A maximum of 8 CPUs per line can be displayed in this manner. However, data truncation may occur before reaching the maximum. That is definitely true when displaying detailed statistics via the `t' command toggle since such data cannot be scaled like the graphic representations.

If one wished to quickly exit adjacent mode without cycling all the way to 8, simply use the `1' command toggle.

   5  :Display-P-Cores-and-E-Cores toggle

This command toggle is only active when the `t' toggle is On and the `1', `2', `3' and `!' toggles are Off, thus showing individual CPU results. It assumes a platform has multiple cores of two distinct types, either multi-threaded (P-Core) or single-threaded (E-Core).

While normally each cpu is displayed as `%Cpu0, %Cpu1, ...', this toggle can be used to identify and/or filter those cpus by their core type, either P-Core (performance) or E-Core (efficient).

The 1st time `5' is struck, each CPU is displayed as `%CpP' or `%CpE' representing the two core types. The 2nd time, only P-Cores (%CpP) will be shown. The 3rd time, only E-Cores (%CpE) are displayed. When this command toggle is struck for the 4th time, the CPU display returns to the normal `%Cpu' convention.

If separate performance and efficient categories are not present, this command toggle will have no effect.

   !  :Combine-Cpus-Mode toggle

This command toggle is intended for massively parallel SMP environments where, even with the `4' command toggle, not all processors can be displayed. With each press of `!' the number of cpus combined is doubled thus reducing the total number of cpu lines displayed.

For example, with the first press of `!' two cpus will be combined and displayed as `0-1, 2-3, ...' instead of the normal `%Cpu0, %Cpu1, %Cpu2, %Cpu3, ...'. With a second `!' command toggle four cpus are combined and shown as `0-3, 4-7, ...'. Then the third `!' press, combining eight cpus, shows as `0-7, 8-15, ...', etc.

Such progression continues until individual cpus are again displayed and impacts both the `1' and `4' toggles (one or multiple columns). Use the `=' command to exit Combine Cpus mode.

Note: If the entire summary area has been toggled Off for any window, you would be left with just the message line. In that way, you will have maximized available task rows but (temporarily) sacrificed the program name in full-screen mode or the `current' window name when in alternate-display mode.

4c. TASK AREA Commands

The task area interactive commands are always available in full-screen mode.

The task area interactive commands are never available in alternate-display mode if the `current' window's task display has been toggled Off (see topic 5. ALTERNATE-DISPLAY Provisions).

APPEARANCE of task window

   J  :Justify-Numeric-Columns toggle

Alternates between right-justified (the default) and left-justified numeric data. If the numeric data completely fills the available column, this command toggle may impact the column header only.

   j  :Justify-Character-Columns toggle

Alternates between left-justified (the default) and right-justified character data. If the character data completely fills the available column, this command toggle may impact the column header only.

      command   sorted-field                  supported 
      A         start time (non-display)      No 
      M         %MEM                          Yes
      N         PID                           Yes
      P         %CPU                          Yes
      T         TIME+                         Yes

4d. COLOR Mapping

When you issue the `Z' interactive command, you will be presented with a separate screen. That screen can be used to change the colors in just the `current' window or in all four windows before returning to the top display.

The following interactive commands are available.

    4 upper case letters to select a target 
    8 numbers to select a color 
    normal toggles available 
        B         :bold disable/enable
        b         :running tasks "bold"/reverse
        z         :color/mono
    other commands available 
        a/w       :apply, then go to next/prior
        <Enter>   :apply and exit
        q         :abandon current changes and exit

If you use `a' or `w' to cycle the targeted window, you will have applied the color scheme that was displayed when you left that window. You can, of course, easily return to any window and reapply different colors or turn colors Off completely with the `z' toggle.

The Color Mapping screen can also be used to change the `current' window/field group in either full-screen mode or alternate-display mode. Whatever was targeted when `q' or <Enter> was pressed will be made current as you return to the top display.

5a. WINDOWS Overview

Field Groups/Windows:

In full-screen mode there is a single window represented by the entire screen. That single window can still be changed to display 1 of 4 different field groups (see the `g' interactive command, repeated below). Each of the 4 field groups has a unique separately configurable summary area and its own configurable task area.

In alternate-display mode, those 4 underlying field groups can now be made visible simultaneously, or can be turned Off individually at your command.

The summary area will always exist, even if it's only the message line. At any given time only one summary area can be displayed. However, depending on your commands, there could be from zero to four separate task displays currently showing on the screen.

Current Window:

The `current' window is the window associated with the summary area and the window to which task related commands are always directed. Since in alternate-display mode you can toggle the task display Off, some commands might be restricted for the `current' window.

A further complication arises when you have toggled the first summary area line Off. With the loss of the window name (the `l' toggled line), you'll not easily know what window is the `current' window.

5b. COMMANDS for Windows

   - | _  :Show/Hide-Window(s) toggles

The `-' key turns the `current' window's task display On and Off. When On, that task area will show a minimum of the columns header you've established with the `f' interactive command. It will also reflect any other task area options/toggles you've applied yielding zero or more tasks.

The `_' key does the same for all task displays. In other words, it switches between the currently visible task display(s) and any task display(s) you had toggled Off. If all 4 task displays are currently visible, this interactive command will leave the summary area as the only display element.

*  = | +  :Equalize/Reset-Window(s)

The `=' key forces the `current' window's task display to be visible. It also reverses any active `i' (idle tasks), `n' (max tasks), `u/U' (user filter), `o/O' (other filter), `v' (hide children), `F' focused, `L' (locate) and `!' (combine cpus) commands. Also, if the window had been scrolled, it will be reset with this command. See topic 5c. SCROLLING a Window for additional information regarding vertical and horizontal scrolling.

The `+' key does the same for all windows. The four task displays will reappear, evenly balanced, while retaining any customizations previously applied beyond those noted for the `=' command toggle.

*  A  :Alternate-Display-Mode toggle

This command will switch between full-screen mode and alternate-display mode.

The first time you issue this command, all four task displays will be shown. Thereafter when you switch modes, you will see only the task display(s) you've chosen to make visible.

*  a | w  :Next-Window-Forward/Backward

This will change the `current' window, which in turn changes the window to which commands are directed. These keys act in a circular fashion so you can reach any desired window using either key.

Assuming the window name is visible (you have not toggled `l' Off), whenever the `current' window name loses its emphasis/color, that's a reminder the task display is Off and many commands will be restricted.

   G  :Change-Window/Field-Group-Name

You will be prompted for a new name to be applied to the `current' window. It does not require that the window name be visible (the `l' toggle to be On).

*

The interactive commands shown with an asterisk (`*') have use beyond alternate-display mode.

    =, A, g    are always available
    a, w       act the same with color mapping
               and fields management

*  g  :Choose-Another-Window/Field-Group

You will be prompted to enter a number between 1 and 4 designating the field group which should be made the `current' window.

In full-screen mode, this command is necessary to alter the `current' window. In alternate-display mode, it is simply a less convenient alternative to the `a' and `w' commands.

5c. SCROLLING a Window

Typically a task window is a partial view into a system's total tasks/threads which shows only some of the available fields/columns. With these scrolling keys, you can move that view vertically or horizontally to reveal any desired task or column.

Up,PgUp  :Scroll-Tasks

Move the view up toward the first task row, until the first task is displayed at the top of the `current' window. The Up arrow key moves a single line while PgUp scrolls the entire window.

Down,PgDn  :Scroll-Tasks

Move the view down toward the last task row, until the last task is the only task displayed at the top of the `current' window. The Down arrow key moves a single line while PgDn scrolls the entire window.

Left,Right  :Scroll-Columns

Move the view of displayable fields horizontally one column at a time.

Note: As a reminder, some fields/columns are not fixed-width but allocated all remaining screen width when visible. When scrolling right or left, that feature may produce some unexpected results initially.

Additionally, there are special provisions for any variable width field when positioned as the last displayed field. Once that field is reached via the right arrow key, and is thus the only column shown, you can continue scrolling horizontally within such a field. See the `C' interactive command below for additional information.

Home  :Jump-to-Home-Position

Reposition the display to the un-scrolled coordinates.

End  :Jump-to-End-Position

Reposition the display so that the rightmost column reflects the last displayable field and the bottom task row represents the last task.

Note: From this position it is still possible to scroll down and right using the arrow keys. This is true until a single column and a single task is left as the only display element.

C  :Show-scroll-coordinates toggle

Toggle an informational message which is displayed whenever the message line is not otherwise being used. That message will take one of two forms depending on whether or not a variable width column has also been scrolled.

  scroll coordinates: y = n/n (tasks), x = n/n (fields)
  scroll coordinates: y = n/n (tasks), x = n/n (fields) + nn

The coordinates shown as n/n are relative to the upper left corner of the `current' window. The additional `+ nn' represents the displacement into a variable width column when it has been scrolled horizontally. Such displacement occurs in normal 8 character tab stop amounts via the right and left arrow keys.

5d. SEARCHING in a Window

You can use these interactive commands to locate a task row containing a particular value.

L  :Locate-a-string

You will be prompted for the case-sensitive string to locate starting from the current window coordinates. There are no restrictions on search string content.

Searches are not limited to values from a single field or column. All of the values displayed in a task row are allowed in a search string. You may include spaces, numbers, symbols and even forest view artwork.

Keying <Enter> with no input will effectively disable the `&' key until a new search string is entered.

&  :Locate-next

Assuming a search string has been established, top will attempt to locate the next occurrence.

When a match is found, the current window is repositioned vertically so the task row containing that string is first. The scroll coordinates message can provide confirmation of such vertical repositioning (see the `C' interactive command). Horizontal scrolling, however, is never altered via searching.

The availability of a matching string will be influenced by the following factors.

5e. FILTERING in a Window

You can use this `Other Filter' feature to establish selection criteria which will then determine which tasks are shown in the `current' window. Such filters can be made persistent if preserved in the rcfile via the `W' interactive command.

Establishing a filter requires: 1) a field name; 2) an operator; and 3) a selection value, as a minimum. This is the most complex of top's user input requirements so, when you make a mistake, command recall will be your friend. Remember the Up/Down arrow keys or their aliases when prompted for input.

Filter Basics

Keyboard Summary

  O  :Other-Filter (upper case)

You will be prompted to establish a case sensitive filter.

  o  :Other-Filter (lower case)

You will be prompted to establish a filter that ignores case when matching.

 ^O  :Show-Active-Filters (Ctrl key + `o')

This can serve as a reminder of which filters are active in the `current' window. A summary will be shown on the message line until you press the <Enter> key.

  =  :Reset-Filtering in current window

This clears all of your selection criteria in the `current' window. It also has additional impact so please see topic 4a. GLOBAL Commands.

  +  :Reset-Filtering in all windows

This clears the selection criteria in all windows, assuming you are in alternate-display mode. As with the `=' interactive command, it too has additional consequences so you might wish to see topic 5b. COMMANDS for Windows.

Input Requirements

        #1           #2  #3              ( required )
        Field-Name   ?   include-if-value
     !  Field-Name   ?   exclude-if-value
     #4                                  ( optional )

Potential Problems

     GROUP=root        ( only the same results when )
     GROUP=ROOT        ( invoked via lower case `o' )

     RES>9999          ( only the same results when )
     !RES<10000        ( memory scaling is at `KiB' )

     nMin>9999         ( always a blank task window )

Potential Solutions

     !nTH=` 1 '                ( ` for clarity only )
     nTH>1                     ( same with less i/p )

     !COMMAND=`       `- '     ( ` for clarity only )

     `PR>20' + `!PR=-'         ( 2 for right result )
     `!nMin=0 ' + `!nMin=1 ' + `!nMin=2 ' + `!nMin=3 ' ...

6a. PERSONAL Configuration File

This file is created or updated via the `W' interactive command.

The legacy version is written as `$HOME/.your-name-4-top' + `rc' with a leading period.

A newly created configuration file is written as procps/your-name-4-top' + `rc' without a leading period. The procps directory will be subordinate to either $XDG_CONFIG_HOME when set as an absolute path or the $HOME/.config directory.

While not intended to be edited manually, here is the general layout:

    global   # line  1: the program name/alias notation
      "      # line  2: id,altscr,irixps,delay,curwin
    per ea   # line  a: winname,fieldscur
    window   # line  b: winflags,sortindx,maxtasks,etc
      "      # line  c: summclr,msgsclr,headclr,taskclr
    global   # line 15: additional miscellaneous settings
      "      # any remaining lines are devoted to optional
      "      # active `other filters' discussed in section 5e above
      "      # plus `inspect' entries discussed in section 6b below

If a valid absolute path to the rcfile cannot be established, customizations made to a running top will be impossible to preserve.

6b. ADDING INSPECT Entries

To exploit the `Y' interactive command, you must add entries at the end of the top personal configuration file. Such entries simply reflect a file to be read or command/pipeline to be executed whose results will then be displayed in a separate scrollable, searchable window.

If you don't know the location or name of your top rcfile, use the `W' interactive command to rewrite it and note those details.

Inspect entries can be added with a redirected echo or by editing the configuration file. Redirecting an echo risks overwriting the rcfile should it replace (>) rather than append (>>) to that file. Conversely, when using an editor care must be taken not to corrupt existing lines, some of which could contain unprintable data or unusual characters depending on the top version under which that configuration file was saved.

Those Inspect entries beginning with a `#' character are ignored, regardless of content. Otherwise they consist of the following 3 elements, each of which must be separated by a tab character (thus 2 `\t' total):

  .type:  literal `file' or `pipe'
  .name:  selection shown on the Inspect screen
  .fmts:  string representing a path or command

The two types of Inspect entries are not interchangeable. Those designated `file' will be accessed using fopen and must reference a single file in the `.fmts' element. Entries specifying `pipe' will employ popen, their `.fmts' element could contain many pipelined commands and, none can be interactive.

If the file or pipeline represented in your `.fmts' deals with the specific PID input or accepted when prompted, then the format string must also contain the `%d' specifier, as these examples illustrate.

  .fmts=  /proc/%d/numa_maps
  .fmts=  lsof -P -p %d

For `pipe' type entries only, you may also wish to redirect stderr to stdout for a more comprehensive result. Thus the format string becomes:

  .fmts=  pmap -x %d 2>&1

Here are examples of both types of Inspect entries as they might appear in the rcfile. The first entry will be ignored due to the initial `#' character. For clarity, the pseudo tab depictions (^I) are surrounded by an extra space but the actual tabs would not be.

  # pipe ^I Sockets ^I lsof -n -P -i 2>&1
  pipe ^I Open Files ^I lsof -P -p %d 2>&1
  file ^I NUMA Info ^I /proc/%d/numa_maps
  pipe ^I Log ^I tail -n100 /var/log/syslog | sort -Mr

Except for the commented entry above, these next examples show what could be echoed to achieve similar results, assuming the rcfile name was `.toprc'. However, due to the embedded tab characters, each of these lines should be preceded by `/bin/echo -e', not just a simple an `echo', to enable backslash interpretation regardless of which shell you use.

  "pipe\tOpen Files\tlsof -P -p %d 2>&1" >> ~/.toprc
  "file\tNUMA Info\t/proc/%d/numa_maps" >> ~/.toprc
  "pipe\tLog\ttail -n200 /var/log/syslog | sort -Mr" >> ~/.toprc

If any inspect entry you create produces output with unprintable characters they will be displayed in either the ^C notation or hexadecimal <FF> form, depending on their value. This applies to tab characters as well, which will show as `^I'. If you want a truer representation, any embedded tabs should be expanded. The following example takes what could have been a `file' entry but employs a `pipe' instead so as to expand the embedded tabs.

  # next would have contained `\t' ...
  # file ^I <your_name> ^I /proc/%d/status
  # but this will eliminate embedded `\t' ...
  pipe ^I <your_name> ^I cat /proc/%d/status | expand -

Note: Some programs might rely on SIGINT to end. Therefore, if a `pipe' such as the following is established, one must use Ctrl-C to terminate it in order to review the results. This is the single occasion where a `^C' will not also terminate top.

  pipe ^I Trace ^I /usr/bin/strace -p %d 2>&1

Lastly, while `pipe' type entries have been discussed in terms of pipelines and commands, there is nothing to prevent you from including shell scripts as well. Perhaps even newly created scripts designed specifically for the `Y' interactive command.

For example, as the number of your Inspect entries grows over time, the `Options:' row will be truncated when screen width is exceeded. That does not affect operation other than to make some selections invisible. However, if some choices are lost to truncation but you want to see more options, there is an easy solution hinted at below.

  Inspection Pause at pid ...
  Use:  left/right then <Enter> ...
  Options:  help  1  2  3  4  5  6  7  8  9  10  11 ...

The entries in the top rcfile would have a number for the `.name' element and the `help' entry would identify a shell script you've written explaining what those numbered selections actually mean. In that way, many more choices can be made visible.

6c. SYSTEM Configuration File

This configuration file represents defaults for users who have not saved their own configuration file. The format mirrors exactly the personal configuration file and can also include `inspect' entries as explained above.

Creating it is a simple process.

1. Configure top appropriately for your installation and preserve that configuration with the `W' interactive command.

2. Add and test any desired `inspect' entries.

3. Copy that configuration file to the /etc/ directory as `topdefaultrc'.

6d. SYSTEM Restrictions File

The presence of this file will influence which version of the help screen is shown to an ordinary user.

More importantly, it will limit what ordinary users are allowed to do when top is running. They will not be able to issue the following commands.

    k        Kill a task
    r        Renice a task
    d or s   Change delay/sleep interval

This configuration file is not created by top. Rather, it is created manually and placed it in the /etc/ directory as `toprc'.

It should have exactly two lines, as shown in this example:

    s        # line 1: secure mode switch
    5.0      # line 2: delay interval in seconds

7a. Kernel Magic

For these stupid tricks, top needs full-screen mode.

• The user interface, through prompts and help, intentionally implies that the delay interval is limited to tenths of a second. However, you're free to set any desired delay. If you want to see Linux at his scheduling best, try a delay of .09 seconds or less.

  For this experiment, under x-windows open an xterm and maximize it. Then do the following:

    . provide a scheduling boost and tiny delay via:
        nice -n -10 top -d.09
    . keep sorted column highlighting Off so as to
      minimize path length
    . turn On reverse row highlighting for emphasis
    . try various sort columns (TIME/MEM work well),
      and normal or reverse sorts to bring the most
      active processes into view

  What you'll see is a very busy Linux doing what he's always done for you, but there was no program available to illustrate this.

• Under an xterm using `white-on-black' colors, on top's Color Mapping screen set the task color to black and be sure that task highlighting is set to bold, not reverse. Then set the delay interval to around .3 seconds.

  After bringing the most active processes into view, what you'll see are the ghostly images of just the currently running tasks.

• Delete the existing rcfile, or create a new symlink. Start this new version then type `T' (a secret key, see topic 4c. Task Area Commands, SORTING) followed by `W' and `q'. Finally, restart the program with -d0 (zero delay).

  Your display will be refreshed at three times the rate of the former top, a 300% speed advantage. As top climbs the TIME ladder, be as patient as you can while speculating on whether or not top will ever reach the top.

7b. Bouncing Windows

For these stupid tricks, top needs alternate-display mode.

• With 3 or 4 task displays visible, pick any window other than the last and turn idle processes Off using the `i' command toggle. Depending on where you applied `i', sometimes several task displays are bouncing and sometimes it's like an accordion, as top tries his best to allocate space.
• Set each window's summary lines differently: one with no memory (`m'); another with no states (`t'); maybe one with nothing at all, just the message line. Then hold down `a' or `w' and watch a variation on bouncing windows  --  hopping windows.
• Display all 4 windows and for each, in turn, set idle processes to Off using the `i' command toggle. You've just entered the "extreme bounce" zone.

7c. The Big Bird Window

This stupid trick also requires alternate-display mode.

•

Display all 4 windows and make sure that 1:Def is the `current' window. Then, keep increasing window size with the `n' interactive command until all the other task displays are "pushed out of the nest".

When they've all been displaced, toggle between all visible/invisible windows using the `_' command toggle. Then ponder this:
is top fibbing or telling honestly your imposed truth?

7d. The Ol' Switcheroo

This stupid trick works best without alternate-display mode, since justification is active on a per window basis.

•

Start top and make COMMAND the last (rightmost) column displayed. If necessary, use the `c' command toggle to display command lines and ensure that forest view mode is active with the `V' command toggle.

Then use the up/down arrow keys to position the display so that some truncated command lines are shown (`+' in last position). You may have to resize your xterm to produce truncation.

Lastly, use the `j' command toggle to make the COMMAND column right justified.

Now use the right arrow key to reach the COMMAND column. Continuing with the right arrow key, watch closely the direction of travel for the command lines being shown.

some lines travel left, while others travel right

eventually all lines will Switcheroo, and move right