Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a software and while it is running, I want to know how much CPU usage or RAM it occupies... along with maybe other things that could be interesting. For that purpose, I need to know exactly what do words like VIRT, SHR, N etc mean. I have tried to find it on Google but could not. Can someone please guide me to a source where I can read about these in detail for the top command?

Also, as per my understanding, %CPU shows CPU usage and %MEMshows the percentage of RAM that is being used. Is that correct?

Also, I don't know how is it possible that at one time 3-4 users are using 100% of CPU and sometimes someone is even using 400%. What does that mean?

share|improve this question
Have you tried man top? – Uwe Plonus Jul 11 '13 at 10:41
Regarding the %CPU, it means that you have (at least) a quad-core CPU or (at least) four processors (or two dual core processors). – user235731 Jul 11 '13 at 10:47
Yes I have tried man top. It only tells me what options I can use. Not how to read the results.` – detraveller Jul 11 '13 at 10:49
up vote 2 down vote accepted

Here is an example output of top:

top - 14:21:40 up 7 days, 21:57,  7 users,  load average: 0.13, 0.04, 0.04
Tasks: 107 total,   2 running, 105 sleeping,   0 stopped,   0 zombie
Cpu0  :  1.0% us,  1.0% sy,  0.0% ni, 96.1% id,  1.9% wa,  0.0% hi,  0.0% si
Cpu1  :  1.0% us,  1.0% sy,  0.0% ni, 98.0% id,  0.0% wa,  0.0% hi,  0.0% si
Mem:   2050756k total,  2034236k used,    16520k free,    22252k buffers
Swap:  2097144k total,    87108k used,  2010036k free,  1609212k cached
  • The first line is easily interpreted, only why there are three different load averages is not obvious: These values use three different time scales.
  • Second line: summary of tasks, grouped by their state
  • The CPU line has two modes, either

    Cpu(s): 1.0% us, 0.5% sy, 0.0% ni, 98.5% id, 0.0% wa, 0.0% hi, 0.0% si

    where all CPU cores are summarized or like in the example above, where every core has its own line. You can toggle between these modes with 1. Every core can be used to 100%, so with two cores the total maximum value ist 200%.

    The two letter abbreviations are bolded in the following list (c&p from an older answer):

    • user: normal processes executing in user mode
    • nice: niced processes executing in user mode
    • system: processes executing in kernel mode
    • idle: twiddling thumbs
    • iowait: waiting for I/O to complete
    • irq: servicing interrupts [hard interrupts hi]
    • softirq: servicing softirqs [soft interrupts si]
    • steal: involuntary wait
  • Mem and Swap is for physical RAM and swap space, respectively.

  • The process list is explained in detail in top`s man page (2a. DESCRIPTIONS of Fields). As your man page seems incomplete, below is an excerpt; there are also copies of the complete man page on the internet. By default these columns are shown (customize with f):


    To address your specific question about the CPU usage: If a process run ins parallel, i.e. can use multiple CPU cores, a usage of 400% indicates, that 4 cores are used completely.

PID -- Process Id: The task's unique process ID, which periodically wraps, though never restarting at zero.

PPID -- Parent Process Pid: The process ID of a task's parent.

RUSER -- Real User Name: The real user name of the task's owner.

UID -- User Id: The effective user ID of the task's owner. Blockquote

USER -- User Name: The effective user name of the task's owner.

GROUP -- Group Name: The effective group name of the task's owner.

TTY -- Controlling Tty: The name of the controlling terminal. This is usually the device (serial port, pty, etc.) from which the process was started, and which it uses for input or output. However, a task need not be associated with a terminal, in which case you'll see '?' displayed.

PR -- Priority: The priority of the task.

NI -- Nice value: The nice value of the task. A negative nice value means higher priority, whereas a positive nice value means lower priority. Zero in this field simply means priority will not be adjusted in determining a task's dispatchability.

P -- Last used CPU (SMP): A number representing the last used processor. In a true SMP environment this will likely change frequently since the kernel inten- tionally uses weak affinity. Also, the very act of running top may break this weak affinity and cause more processes to change CPUs more often (because of the extra demand for cpu time).

%CPU -- CPU usage: The task's share of the elapsed CPU time since the last screen update, expressed as a percentage of total CPU time. In a true SMP environment, if 'Irix mode' is Off, top will operate in 'Solaris mode' where a task's cpu usage will be divided by the total number of CPUs. You toggle 'Irix/Solaris' modes with the 'I' interactive command.

TIME -- CPU Time: Total CPU time the task has used since it started. When 'Cumulative mode' is On, each process is listed with the cpu time that it and its dead children has used. You toggle 'Cumulative mode' with 'S', which is a command-line option and an interactive command. See the 'S' interactive command for additional information regarding this mode.

TIME+ -- CPU Time, hundredths: The same as 'TIME', but reflecting more granularity through hundredths of a second.

%MEM -- Memory usage (RES): A task's currently used share of available physical memory.

VIRT -- Virtual Image (kb): The total amount of virtual memory used by the task. It includes all code, data and shared libraries plus pages that have been swapped out. VIRT = SWAP + RES

SWAP -- Swapped size (kb): The swapped out portion of a task's total virtual memory image.

RES -- Resident size (kb): The non-swapped physical memory a task has used. RES = CODE + DATA

CODE -- Code size (kb): The amount of physical memory devoted to executable code, also known as the 'text resident set' size or TRS.

DATA -- Data+Stack size (kb): The amount of physical memory devoted to other than executable code, also known as the 'data resident set' size or DRS.

SHR -- Shared Mem size (kb): The amount of shared memory used by a task. It simply reflects memory that could be potentially shared with other processes.

nFLT -- Page Fault count: The number of major page faults that have occurred for a task. A page fault occurs when a process attempts to read from or write to a virtual page that is not currently present in its address space. A major page fault is when disk access is involved in making that page available.

nDRT -- Dirty Pages count: The number of pages that have been modified since they were last written to disk. Dirty pages must be written to disk before the cor- responding physical memory location can be used for some other virtual page.

S -- Process Status The status of the task which can be one of: D = uninterruptible sleep, R = running, S = sleeping, T = traced or stopped, Z = zombie. Tasks shown as running should be more properly thought of as 'ready to run' -- their task_struct is simply represented on the Linux run-queue. Even without a true SMP machine, you may see numerous tasks in this state depending on top's delay interval and nice value.

Command -- Command line or Program name: Display the command line used to start a task or the name of the associated program. You toggle between command line and name with 'c', which is both a command-line option and an interactive command. When you've chosen to display command lines, processes without a command line (like kernel threads) will be shown with only the pro- gram name in parentheses, as in this example: ( mdrecoveryd ) Either form of display is subject to potential truncation if it's too long to fit in this field's current width. That width depends upon other fields selected, their order and the current screen width. Note: The 'Command' field/column is unique, in that it is not fixed-width. When displayed, this column will be allocated all remain- ing screen width (up to the maximum 512 characters) to provide for the potential growth of program names into command lines.

WCHAN -- Sleeping in Function: Depending on the availability of the kernel link map (''), this field will show the name or the address of the kernel func- tion in which the task is currently sleeping. Running tasks will display a dash ('-') in this column. Note: By displaying this field, top's own working set will be increased by over 700Kb. Your only means of reducing that overhead will be to stop and restart top.

Flags -- Task Flags: This column represents the task's current scheduling flags which are expressed in hexadecimal notation and with zeros suppressed. These flags are officially documented in . Less formal documentation can also be found on the 'Fields select' and 'Order fields' screens.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.