Using the top command to check CPU utilization in Linux gives you a live, sorted view of running processes. This guide shows you exactly how to check cpu utilization in linux using top command, step by step.
CPU utilization is one of the most important metrics for system performance. When your server feels slow or unresponsive, the first thing you should check is how much CPU is being used.
The top command is built into almost every Linux distribution. You don’t need to install anything extra. It refreshes every few seconds, giving you real-time data.
Let’s jump right in and see how to use it effectively.
How To Check Cpu Utilization In Linux Using Top Command
Open your terminal. Type top and press Enter. You’ll see a screen full of information. Don’t worry—it looks complicated, but it’s easy to read once you know what to look for.
The top part of the output shows system summary lines. The second line from the top shows CPU statistics. Look for the line that starts with “%Cpu(s)”.
This line breaks down CPU usage into categories:
- us – user space processes (your applications)
- sy – system (kernel) processes
- ni – nice (low priority) processes
- id – idle CPU time
- wa – waiting for I/O (disk or network)
- hi – hardware interrupts
- si – software interrupts
- st – stolen time (virtual machines)
For a quick check, focus on the id value. If idle is low (like under 20%), your CPU is working hard. If idle is high (over 80%), your CPU has plenty of headroom.
Reading The Process List
Below the summary lines, you see a list of processes. Each row is one process. The columns include:
- PID – Process ID
- USER – Who owns the process
- PR – Priority
- NI – Nice value
- VIRT – Virtual memory used
- RES – Resident memory used
- SHR – Shared memory
- S – Process status (R=running, S=sleeping, Z=zombie)
- %CPU – CPU usage percentage
- %MEM – Memory usage percentage
- TIME+ – Total CPU time used
- COMMAND – The command that started the process
The %CPU column is what you care about most. Processes are sorted by CPU usage by default, with the highest at the top.
If you see a process using 100% CPU, it might be stuck in a loop or doing heavy work. If multiple processes add up to over 100%, that’s normal on multi-core systems.
Sorting By Different Columns
By default, top sorts by CPU usage. But you can sort by other columns too. Press the following keys while top is running:
- P – Sort by CPU usage (default)
- M – Sort by memory usage
- T – Sort by running time
- N – Sort by process ID
This helps you find the most resource-hungry processes quickly. For example, if you’re checking memory leaks, press M to see which processes use the most RAM.
Filtering Processes By User
Sometimes you want to see only processes owned by a specific user. Press u while top is running. Then type the username and press Enter.
For example, if you type www-data, you’ll see only web server processes. This is useful when troubleshooting a specific application.
To remove the filter, press u again and leave the field empty.
Changing The Update Interval
The default refresh interval is 3 seconds. You can change it. Press d (or s on some versions) and type a new number in seconds.
For faster updates, use 1 second. For slower updates when monitoring over time, use 5 or 10 seconds. This reduces CPU overhead from top itself.
Showing Only Active Processes
By default, top shows all processes, including idle ones. To see only active processes, press i. This toggles “idle processes” on and off.
When you enable this, you’ll see only processes that are currently using CPU. This declutters the screen and helps you focus on what’s actually running.
Killing A Process From Top
If you find a process that’s using too much CPU and needs to be stopped, you can kill it directly from top. Press k. Enter the PID of the process. Then enter the signal number.
The most common signals are:
- 15 (SIGTERM) – Graceful termination
- 9 (SIGKILL) – Force kill
- 1 (SIGHUP) – Reload configuration
Use SIGTERM first. Only use SIGKILL if the process doesn’t respond. Killing a process forcefully can cause data loss.
Understanding Multi-Core CPU Usage
On systems with multiple CPU cores, top shows average usage across all cores by default. To see individual core usage, press 1 (the number one).
This expands the CPU line into separate lines for each core. You might see something like:
%Cpu0 : 50.0 us, 10.0 sy, 0.0 ni, 40.0 id, 0.0 wa
%Cpu1 : 30.0 us, 5.0 sy, 0.0 ni, 65.0 id, 0.0 wa
If one core is at 100% while others are idle, you might have a single-threaded bottleneck. If all cores are high, you have a general CPU bottleneck.
Saving Top Output To A File
Sometimes you need to save the output for later analysis. You can use the -b (batch) option. This runs top once and exits, outputting the data to stdout.
Example: top -b -n 1 > cpu_snapshot.txt
This captures one snapshot. For multiple snapshots, use -n 5 for five updates. You can also use -d 2 to set the delay to 2 seconds between snapshots.
This is useful for logging CPU usage over time or for debugging issues that happen intermittently.
Using Top With Custom Configuration
Top has a configuration file at ~/.toprc. You can customize colors, columns, and default settings. To create a config, press W while top is running. This saves your current settings.
You can also start top with specific options from the command line:
top -u username– Show only processes for that usertop -p 1234,5678– Monitor specific PIDstop -d 5– Set delay to 5 secondstop -n 10– Run for 10 iterations, then exit
These command-line options save time if you frequently check the same things.
Common Issues And Troubleshooting
Sometimes top shows very high CPU usage, but you can’t find the culprit. Here are a few things to check:
- Zombie processes – Look for status Z. These are dead processes that haven’t been cleaned up.
- Kernel threads – These appear in brackets like [kworker]. High kernel CPU usage might indicate hardware issues.
- I/O wait – If wa is high, your disk or network is slow. The CPU is waiting for data.
- Stolen time – If st is high on a virtual machine, your host is overcommitted.
If you see high CPU but no process seems responsible, check for hidden processes or kernel bugs. Run ps aux --sort=-%cpu as a cross-check.
Comparing Top With Other Tools
Top is great for quick checks, but other tools offer different views:
- htop – More user-friendly, with colors and mouse support
- atop – Shows historical data and disk/network usage
- glances – Web-based monitoring with many metrics
- vmstat – Shows system-wide CPU, memory, and I/O
- mpstat – Detailed per-core CPU statistics
For deep dives, use these tools together. But for 90% of daily checks, top is all you need.
Automating CPU Monitoring With Top
You can script top to alert you when CPU usage is high. Here’s a simple bash script:
#!/bin/bash
CPU_THRESHOLD=90
while true; do
CPU=$(top -b -n 1 | grep "%Cpu(s)" | awk '{print $8}')
if (( $(echo "$CPU < 10" | bc -l) )); then
echo "Warning: CPU idle below 10%"
fi
sleep 5
done
This script checks every 5 seconds. If idle CPU drops below 10%, it prints a warning. You can extend it to send emails or trigger other actions.
Understanding CPU Steal Time
If you’re using a virtual machine, pay attention to the st value. Steal time means the hypervisor is taking CPU cycles away from your VM to give to other VMs.
High steal time (over 10%) indicates your cloud provider is overcommitting resources. You might need to upgrade to a dedicated instance or switch providers.
Top shows steal time in the CPU summary line. If you see st=20%, that means 20% of your CPU time is being stolen.
Using Top In Batch Mode For Scripts
Batch mode is perfect for scripts. The -b flag makes top output plain text without the interactive interface. Combine it with -n for multiple iterations.
Example: top -b -n 3 -d 2 | grep "Cpu(s)"
This runs three times, two seconds apart, and shows only the CPU summary lines. You can pipe this to a log file or parse it with awk.
Customizing Top Display
You can hide or show columns in top. Press f to enter the field management screen. Use arrow keys to navigate, and press d to toggle a field on or off.
Common fields to add:
- nTH – Number of threads
- P – Last used CPU core
- WCHAN – What the process is waiting for
Press q to exit the field screen. Your changes take effect immediately.
Monitoring Specific Processes Over Time
To watch a single process, use top -p PID. Replace PID with the actual process ID. You can monitor multiple processes by listing PIDs separated by commas.
Example: top -p 1234,5678
This shows only those two processes. Useful when debugging a specific application without distraction.
Interpreting CPU Usage Percentages
On a single-core system, 100% CPU means the core is fully utilized. On a quad-core system, 100% means one core is maxed out, and 400% means all cores are maxed.
Top shows CPU as a percentage of one core. So 200% means two cores are fully used. This is important when reading the %CPU column for individual processes.
If a process shows 150%, it’s using 1.5 cores. This is normal for multi-threaded applications.
Common Mistakes When Using Top
Here are mistakes people often make:
- Misreading the idle value – Remember, idle is the percentage of CPU doing nothing. Low idle means high usage.
- Ignoring I/O wait – High wa means slow disk, not necessarily a CPU problem.
- Not checking for zombie processes – Zombies don’t use CPU but indicate a bug.
- Forgetting about nice values – Processes with high nice values get less CPU time.
Avoid these, and you’ll interpret top correctly every time.
When To Use Top Vs. Other Commands
Use top when you need real-time, interactive monitoring. Use ps for a one-time snapshot. Use htop if you prefer a nicer interface. Use sar for historical data.
For automated alerts, use top in batch mode or use a dedicated monitoring tool like Nagios or Prometheus.
Frequently Asked Questions
What Does The %CPU Column In Top Show?
The %CPU column shows the percentage of CPU time used by each process, relative to a single core. On multi-core systems, a process can exceed 100% if it uses multiple cores.
How Do I Check CPU Utilization Per Core In Top?
Press the number 1 key while top is running. This expands the CPU summary to show each core individually. Press 1 again to collapse back to the average.
Why Does Top Show More Than 100% CPU Usage?
On multi-core systems, CPU usage is calculated per core. If a process uses two cores fully, it shows 200%. This is normal for multi-threaded applications.
Can I Save Top Output To A File Automatically?
Yes. Use top -b -n 1 > output.txt for a single snapshot. Use top -b -n 10 -d 5 > log.txt for ten snapshots taken five seconds apart.
What Is The Difference Between Us, Sy, And Ni In Top?
us is user space CPU time (your applications). sy is system CPU time (kernel operations). ni is CPU time used by processes with a modified nice value (lower priority).
How Do I Find Which Process Is Using The Most CPU?
Simply run top. Processes are sorted by CPU usage by default, with the highest at the top. The %CPU column shows exactly how much each process uses.
Is Top Available On All Linux Distributions?
Yes, top is part of the procps-ng package, which is installed by default on virtually all Linux distributions. You don’t need to install anything extra.
Final Thoughts
Checking CPU utilization with top is a fundamental skill for any Linux user. The command gives you instant, actionable data about what’s happening on your system.
Start by running top and looking at the %Cpu(s) line. Check the idle value. If it’s low, look at the process list to find the culprit. Use the sorting and filtering options to narrow down the issue.
With practice, you’ll be able to diagnose performance problems in seconds. Top is simple, powerful, and always available. Master it, and you’ll never be lost when your system slows down.
Remember to use the batch mode for scripting, the interactive keys for real-time monitoring, and the configuration options to customize your view. These tips will make you efficient and effective.
Now go ahead and open your terminal. Run top and explore the options we discussed. The more you use it, the more natural it becomes.