All about "TOP"

Review of almost all *top utilities for linux (atop, iotop, htop, foobartop, etc.)

We all know that top is the simplest and most common utility in this list. It shows roughly the same as vmstat utility in addition to that it provides rating of processes for the consumption of the memory or the CPU. It does not know anything about the network loading or discs. It allows a minimal set of operations with the process: renice and kill. A suffix "top" got all the other similar utilities in this review.


Atop is an ASCII full-screen performance monitor that is capable of reporting the activity of all processes (even if processes have finished during the interval), daily logging of system and process activity for long-term analysis, highlighting overloaded system resources by using colors, etc. At regular intervals, it shows system-level activity related to the CPU, memory, swap, disks, and network layers, and for every active process it shows the CPU utilization, the memory growth, priority, username, state, and exit code.

In contrast to the top, it knows about the existence of block devices and network interfaces, as well it is capable to show their loading as a percentage (at 10G, however, a percentage does not work, but at least it shows the number of megabytes).

It is essential utility for finding lag sources on the server, as well it saves the statistics of system loading and performance of each process, so we can see what exactly was the reason: IO programs, swap (lack of memory), CPU, or something else. In addition, it is capable to suggest by two colors what options are beyond the reasonable limits.


In contrast to the atop, it does not collect statistics, but it simply displays the current status. The second difference is a panel like Norton has on the taskbar with button hints below and the ability to navigate through the list of processes.

It supports the process selection and execution of group operations on them.

It reports little statistics on the system, but it has extensive tools for the process analysis, including the scheduling (affinity priorities), viewing a list of open files, strace and a lot of small features, such as contextual search by process name, process tracking mode, fast process operations, etc.


It tells us what process is grinding our hard drive. It can indicate kcopy/swapper/kflush as the grinding source of hard disk thanks to kernel threads (atop cannot do this). At the same time, it shows the total load of IO system in MB/s and it is pretty fast.


It is a command-line system monitor utility that produces a frequently-updated list of network connections. It works the same as tcpdump. It shows the interface loading (only one interface per a button is supported), traffic direction and traffic intensity.

It allows quickly to find the direction, where the most traffic goes (in either direction) when a medium-loaded server suddenly began to use it. Unfortunately, it does not show the traffic distribution per processes.


It is a software utility designed to measure, explain and minimise a computer's electrical power consumption. It was released by Intel in 2007. Actuality, it does not show Watts, but it shows the time that is spent on the service by a CPU. It is unique, because it shows the interrupts and other kernel events on the same level with the processes (which allows finding non-trivial situation of server overloading and even determining what caused it). When the load is equal, it allows measuring which driver is working quicker.

In addition, it allows measuring the degree of device driver load in the device stats tab. Also, it shows pps (packets per seconds) for the network interface cards (including virtual, such as tun).

It shows the distribution of processor statuses (C1, C2, C3) in idle status tab, which is very useful for finding out if a battery is dead or something wrong with the system in laptops.


It is a very specialized utility for monitoring interrupts and the identification them by a number.

It shows linux kernel function information usage (modules not included) like top does for process, and is derived from readprofile.


It is a specialized analyzer that displays various tables of DNS traffic on the network, including tables of source and destination IP addresses, query types, top level domains and second level domains. Probably, it would have been very helpful for fixing the DNS for the domain controller, unfortunately, Active Directory on Linux does not work very well.

It is a traffic visualiser, which captures traffic going through the host it is running from and displays streams sorted by bandwidth they use.

It is a curses-based utility that polls hosts to determine connectivity. Simple network top (sntop) is a curses-based console utility, in the spirit of top, that polls network hosts at a regular interval to determine their connectivity and displays the results in a pretty format. Advanced features, such as automatic HTML generation of results, secure terminal mode, execution of external file on connectivity change, and user/system configure files, are supported.

It is a Linux application for identifying operating system latency within the kernel and find out the operations/actions which cause the latency.


It is monitor server resources used by X11 clients that uses the X-Resource extension to provide 'top'-like statistics of each connected X11 client's server-side resource usage. It is intended as a developer tool to aid more efficient server resource usage and debug server-side resource leakage.


It displays detailed kernel slab cache information in real time. Also, It displays a listing of the top caches sorted by one of the listed sort criterias.

Software specific

It is a curses-based top-like display for Apache information, including requests per second, bytes per second, most popular URLs, etc.

It is a console application to display information about currently active client connections for a Squid proxy in a convenient way.

It is 'top' for PostgreSQL. It is derived from Unix Top. Similar to top, pg_top allows you to monitor PostgreSQL processes.


It is a console-based tool for monitoring the threads and overall performance of a MySQL 3.22.x, 3.23.x, and 4.x server. It runs on most Unix systems (including Mac OS X)


It displays information about the Xen system and domains, in a continually-updating manner. Command-line options and interactive commands can change the detail and format of the information displayed by xentop.

Here is a list of some tops:
hatop - haproxy monitoring.
virt-top - libvirt monitoring.
mctop - memcached monitoring.
perf-top - system profiling tool (here is documentation).

Here are some false tops:
gkrelmtop – a plugin for gkrellm (It displays the top three cpu intensive, or memory consuming, or I/O busy processes).
ntop - violates the tradition of text-based interactive programs and is used as a site for apache.
libgtop - a library for the performance monitoring.
nload - a console application which monitors network traffic and bandwidth usage in real time.

Here are some tops without a respectful suffix 'top' in the title.


It is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process. NetHogs does not rely on a special kernel module to be loaded.


It displays information held in the IP Tables state table in real-time in a top-like format. Output can be sorted by any field, or any field reversed. Users can choose to have the output only print once and exit, rather than the top-like system. Refresh rate is configurable, IPs can be resolved to names, output can be formatted, the display can be filtered, and color coding are among some of the many features.
MeLavi 10 november 2011, 13:14
Vote for this post
Bring it to the Main Page


Leave a Reply

Avaible tags
  • <b>...</b>highlighting important text on the page in bold
  • <i>..</i>highlighting important text on the page in italic
  • <u>...</u>allocated with tag <u> text shownas underlined
  • <s>...</s>allocated with tag <s> text shown as strikethrough
  • <sup>...</sup>, <sub>...</sub>text in the tag <sup> appears as a superscript, <sub> - subscript
  • <blockquote>...</blockquote>For  highlight citation, use the tag <blockquote>
  • <code lang="lang">...</code>highlighting the program code (supported by bash, cpp, cs, css, xml, html, java, javascript, lisp, lua, php, perl, python, ruby, sql, scala, text)
  • <a href="http://...">...</a>link, specify the desired Internet address in the href attribute
  • <img src="http://..." alt="text" />specify the full path of image in the src attribute