top
what is the machine doing right nowtop is a live view of the system. The header gives the load, the CPU split and the memory in use; the table beneath lists processes, refreshed every few seconds and sorted so the one using the most CPU is at the top.
ps is a photograph; top is the live picture — the first thing to open when a machine feels slow.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
The three load figures are averages over 1, 5 and 15 minutes. Compare them with the number of CPU cores: a load of 4 is busy on two cores and idle on sixteen.
us is user programs, sy the kernel, id idle. wa is time spent waiting for disk — a high wa means the disk, not the processor, is the bottleneck.
Linux uses spare memory as disk cache, so free looks small on a healthy machine. "avail Mem" on the next line is what programs can still have.
RES is the memory actually in use, %CPU is of one core, and S is the state: R running, S sleeping, Z zombie.
Switches
A switch changes how the command behaves. These are the ones used day to day; man top lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-b- Batch mode: print plain text instead of taking over the screen — for scripts and pipes.
-n NUM- Refresh NUM times, then exit.
-d SECS- Wait this many seconds between refreshes.
-u USER- Show only this user’s processes.
-p PID- Watch only the processes with these ids.
-H- Show individual threads instead of whole processes.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
topThe live view. Press M to sort by memory, P by CPU, 1 to show each core, q to quit.
top -u www-dataShows only one user’s processes.
top -b -n 1 -o %MEM | head -15A single snapshot sorted by memory, suitable for a script or a log.
top -p 812Watches a single process by its id.
In cybersecurity
A process that has no business running usually gives itself away by what it consumes.
A process using a whole core around the clock, under a web-server or service account, is the usual sign of a crypto-miner dropped through a vulnerable application.
The COMMAND column shows what the process chose to call itself. Check the real binary with "ls -l /proc/PID/exe" before trusting a familiar name.
By default any user can list all processes and their command lines. Secrets passed as arguments are visible here to every account.