Linux top command usage details

View multi-core CPU commands
Mpstat-p all and sar-P ALL

Note:Sar-p all> aaa.txt redirects the output content to the aaa.txt file.

Top commands are often used to monitor linux system conditions, such as cpu and memory usage. Programmers generally know this command, but it is strange that few people can use it well, for example, the memory value in the top monitoring view has many misinterpretations.

This article describes the meaning of various data in the top view through top monitoring of a running WEB server, and sorts the fields of various processes (tasks) in the view.

Top entry View

Top view 01
[Top View 01] is the basic view of top. We will use this view to explain the meaning of each data.

The first line:
10:01:23-current system time
126 days,-the system has been running for 126 days, 14 hours, and 29 minutes (no restart during this period)
2 users-there are currently two users logging on to the system
Load average: 1.15, 1.42, 1.44-load average the following three numbers are 1 minute, 5 minutes, 15 minutes of load respectively
The load average data checks the number of active processes every five seconds and then calculates the value based on a specific algorithm. If this number is divided by the number of logical CPUs, the system is overloaded when the result is higher than 5.

Row 2:
Tasks-task (process), the system now has a total of 183 processes, of which one is running, 182 are sleeping, and 0 are stoped, zombie status (zombie) has 0.

Row 3: cpu status
6.7% us-Percentage of CPU used by user space.
0.4% sy-Percentage of CPU occupied by kernel space.
0.0% ni-Percentage of CPU used by processes with changed priorities
92.9% id-Percentage of idle CPU
0.0% percentage of CPU occupied by wa-IO wait
0.0% hi-Percentage of CPU used by Hardware IRQ
0.0% CPU usage of si-Soft Interrupt (Software Interrupts)
Here, the CPU usage rate is different from that of windows. If you do not understand the user space and kernel space, you need to recharge your instance.

Row 4: memory status
8306544 k total-total physical memory (8 GB)
7775876 k used-total memory in use (7.7 GB)
530668 k free-total idle memory (530 MB)
79236 k buffers-cache memory (79 M)

Row 5: swap Partition
2031608 k total-total swap zone (2 GB)
2556 k used-Total number of swap zones used (2.5 M)
2029052 k free-Total number of free swap areas (2 GB)
4231276 k cached-total buffer swap zone (4 GB)

It should be noted that the concept of memory in windows cannot be used to understand the data. If the server is "dangerous" in windows mode: 8 GB memory is left with only MB of available memory. Linux memory management has its own particularity, And the complexity needs to be explained in a book. Here is just a simple introduction and our traditional concepts (windows) are different.

In Row 4, the total memory used (used) refers to the number of memories currently controlled by the system kernel. The total idle memory (free) is the amount of memory that the kernel has not yet incorporated into its control scope. The memory included in the kernel management is not always in use, but also the memory that can be reused in the past, the kernel does not return the reusable memory to free. Therefore, free memory will become fewer and fewer on linux, but you don't have to worry about it.

If you calculate the number of available memory out of habit, there is an approximate formula: free in the fourth row + buffers in the fourth row + cached in the fifth row, according to this formula, the available memory of this server is 530668 + 79236 + 4231276 = 4.7 GB.

For memory monitoring, we need to monitor the used of the fifth-line swap partition in top. If this value is constantly changing, it means that the kernel is constantly exchanging data between memory and swap, this is the real insufficient memory.

Row 6 is empty

Line 7: Status monitoring of processes (tasks)
PID-process id
USER-process owner
PR-process priority
NI-nice value. A negative value indicates a high priority, and a positive value indicates a low priority.
VIRT-Total virtual memory used by the process, in kb. VIRT = SWAP + RES
RES-physical memory used by the process, not swapped out, in kb. RES = CODE + DATA
SHR-shared memory size, in kb
S-Process status. D = non-disruptive sleep state R = running S = sleep T = tracking/stopping Z = botnets
% CPU-Percentage of CPU time occupied since the last update
% MEM-Percentage of physical memory used by the Process
TIME +-total cpu time used by the process, in the unit of 1/100 seconds
COMMAND-process name (COMMAND name/COMMAND line)

---------------------------------------------------------------


Multi-U multi-core CPU monitoring
In the top basic view, press the keyboard number "1" to monitor the status of each logical CPU:

Top view 02

Observe that the server has 16 logical CPUs, which are actually 4 physical CPUs.

 

Process Field sorting
By default, processes are sorted by CPU usage. In [top View 01], java processes with a process ID of 14210 are ranked first (100% of cpu usage ), java processes with a process ID of 14183 rank second (cpu usage: 12% ).
You can use a Keyboard Command to change the sorting field. For example, if you want to monitor which process occupies the most MEM resources, you can use the following methods:

1. Press "B" on the keyboard (enable/disable the highlight effect). The top view changes as follows:

Top view 03

We found that the "top" process with process id 10704 is highlighted, and the top process is the only running process shown in the second row of the view, you can press the "y" key to close or enable the brightening Effect of running processes.

2. Press "x" on the keyboard (enable/disable the highlight effect of the sorting column). The top view changes as follows:

Top view 04

As you can see, the default sorting column of top is "% CPU ".

3. "shift +>" or "shift + <" can be used to change the sorting column to the right or left, which is based on "shift +>" once:

Top view 05

The view is now sorted by % MEM.

Change the process display field

1. Press the "f" key and top to enter another view. Here, you can orchestrate the display fields in the basic view:

All process fields that can be displayed in the top basic view are listed. Fields marked with "*" and uppercase letters are displayed, fields without "*" and lowercase letters are not displayed. To display the "CODE" and "DATA" fields in the basic view, you can press the "r" and "s" keys:

Top view 07

2. Press enter to return to the basic view. You can see two more fields: "CODE" and "DATA:

Top view 08

Add top Command
The top command is the preferred command for system monitoring on Linux, but sometimes it does not meet our requirements. For example, the current server, top monitoring has great limitations. This server runs the websphere cluster and has two node services: The boss and the second java processes in [top View 01]. The smallest unit of top Command monitoring is the process, therefore, I cannot see the number of java threads and the number of client connections that I care about. These two indicators are very important indicators of java web Services. Generally, I use the ps and netstate commands to supplement the lack of top.

Number of java threads monitored:
Ps-eLf | grep java | wc-l

Number of monitored network customer connections:
Netstat-n | grep tcp | grep listening port | wc-l

The preceding two commands can modify the grep parameter to meet more detailed monitoring requirements.
Under the guidance of "Everything is a file" in Linux, all processes can run in a file. In the system root directory/proc, the name of each digital subdirectory is the PID of the running process. You can enter any process directory and observe the running indicators of the process through the files or directories, for example, the task directory is used to describe the threads in a process. Therefore, you can use the following method to obtain the number of threads running in a process (PID indicates the process ID ):

Ls/proc/PID/task | wc-l

In linux, there is also a command pmap to output the process memory status, which can be used to analyze the thread Stack:
Pmap PID