There is a lot of information displayed in this window, and it is constantly being updated. (If you have the CPU monitor applet running, you will see periodic spikes as the updates occur.) For clarity in this guide, this window's display can be divided into three areas. The top shows menubars, options, and a graphical summary. The central area shows fields of process information. The statusline shows a summary of other machine information at the base of the window.
At the top of the display are the menubar and the toolbar. These are explained in the menubar section. If gtop is using the 'notebook' display format (this is set in the Preferences dialogue), then beneath the toolbar you will also see a list of the three displays you can view: processes, memory use and filesystem use; with the current display highlighted. Beneath these is a graphical summary of the machine's state.
The fluctuating graphs visible show:
CPU use;
Memory use;
Swap space use;
The load average.
CPU: The colours for the display are configurable with the Preferences dialogue but default values are:
programs running in user-mode: default colour is yellow
programs at low priority: default colour is pale grey
programs runing in kernel-mode: default colour is dark grey
amount of idle CPU: default colour is black
These vary in quantity as the CPU usage changes, giving you an idea of how busy your CPU is. The actual figures can be seen in percentage form at the base of the gtop display.
MEM: The colours for the display are configurable with the Preferences dialogue but default values are:
free, ie unused, memory: default colour is dark green
buffers, or memory which is holding such things as data which has not yet been written to the disk, and data which has been read from the disk and kept in memory just in case it is needed again: default colour is dark grey
shared memory: memory containing information that more than one program is using: default colour is yellow
other: default colour is mucky yellow-green
These vary in quantity as programs require or yield memory. Because operating systems vary, it is not easy to compare these numbers across operating systems.
SW: The colours for the swap space in use are configurable with the Preferences dialogue but default values are:
swap space in use: default colour is red
swap space not in use: default colour is dark green
On Solaris, the amount of swap space available can change whilst the system is running.
The swap space is a part of the hard drive which is not part of the filesystem. When the kernel decides a program in memory is not being used a lot but might be required soon, it takes parts of the program (called 'pages') out of memory and puts those into the swap space, where it can easily retrieve it. This is called swapping. If the data is put back into memory, the swap space is not immediately freed up, which means its use may look higher than it really is.
LA: The colours for the current load average are configurable with the Preferences dialogue but default values are:
load average: default colour is red
background colour: default colour is green
The load average is a representation of how "busy" your machine is. The figures can be seen at the base of the display in a group of three. The first is the load average over the last minute, the second is the load average of the last 5 minutes, and the third is the load average of the last 15 minutes. When the load average over the last 15 minutes is consistently over 1.0, then the CPU on a single-processor machine is constantly in use at 100% of its capacity. The effect of different load averages will vary by machine. Whilst a single-processor machine may feel horribly slow with a load average of 0.8, a multi-processor machine showing the same load average will feel far less 'busy'. (For the curious wondering why it's called a load average, it is calculated over time as an average from the number of processes which show up as R or D. See Stat below for what these mean.)
This is where the most information can be seen. Those familiar with the top program will recognise it easily. The display can be customised with the Preferences dialogue box, but the default settings include all but three information fields. There are two scrollbars: horizontal and vertical. To see everything on the display, you will certainly need to use the vertical scrollbar. You will probably need the horizontal one too.
PID: process identification.
This is the unique number of the process. No two processes will have the same number.
user: the name of the user owning the process.
This is normally the user who started the program, but not always. For example, a user can start X running, but the resulting X process is owned and controlled by root. There is also a special user called 'nobody' which runs quite a lot of things. So if 'nobody' is the user, it does not mean that the process is unowned and uncontrolled.
Pri: the priority of the process
Priority controls how much access the process can get to the CPU. The normal priority is zero. See the field called Ni, too.
Ni: the 'nice' value of the process
This field is not shown by default. You can nice a process (see manipulating processes), which then lowers its priority. This is called nice because it is a sociable thing to do for programs which don't need high priority. It is often done with resource-hungry programs which do not need interactive input in order to stop them using all the system's resources. The super-user can nice a process in the opposite direction to give it a higher priority. The range is from -20 (not nice and high-priority) to +19 (nice and low-priority). See the field called Pri, too.
Size: the size of the code, data and stack space (everything it need to run, in other words), in kilobytes.
This is a very rough guide, as it depends on how much memory the process has been allocated, not how much of that it is actually using. It may well not be using it all. So it is a bad way to look at how big a program is. A better way to find out what is in memory is the RSS field.
RSS: the resident memory set size
This is not shown by default. This is the total amount of physical memory (it does not include swap space) in kilobytes being used by the process. If shared libraries are used by the program, that is added into the total.
Resident: the resident memory size.
On BSD and Solaris systems, this field has the same value as the RSS field. See the previous entry for what that means. On Linux, it is the size of the process including what has been swapped out. It is displayed in kilobytes.
Share: shared memory
This field is not shown by default. It is the amount of shared memory used by the process, shown in kilobytes. It includes memory, but not swap space. Shared memory is memory which more than one program is using, saving space.
Stat: the state of the process
This is what the process is doing currently. The symbols you will see here are:
R = running;
S = sleeping;
D = uninterruptible sleep. The process is asleep and waiting for a wake-up call.
Z = zombie. A zombie process is dead and waiting for its parent process to clean it up;
T = stopped or traced. Tracing a process means looking at a list of output for every single little thing it does.
Sometimes a second symbol is visible:
W = the entirety of the program (not just part of it) has been swapped to disk; or the process is currently in the middle of swapping.
N = niced (positive value), so having less CPU time than normal. See Pri and Ni.
< = niced (negative value), so able to get more CPU time than normal. See Pri and Ni.
CPU: the CPU use of the process
This is what percentage of the total CPU time available the process is using.
MEM: the memory use of the process
The amount of memory currently being used, as a percentage.
Time: the total time the process has spent talking to the CPU.
This is only how much time the process has spent talking to the CPU. It does not tell you much about how long the program has been running, because different programs require different amounts of CPU time.
UTime: the total usertime of the process.
This is not shown by default. It is the total time spent in "userspace": running the application without talking to the kernel, in other words.
STime: the total system time of the process.
This is not shown by default. This is the amount of time the process has spent running kernel code. This is often required if the program needs to do I/O: to move things from disk to memory, from memory to disk, or around a network, for example.
Cmd: command
This is the command which the process is running. If it is in brackets, then the program has been 'swapped out' and is on the disk, not in memory. It needs to be swapped back (by the system, not the user) into memory before it will do more.
There are (by default) four boxes at the base of the display. You can change this, adding more or removing some, if you alter your preferences.
If you shrink the display horizontally, you may find that some of the boxes are no longer visible. The left-most of the default four boxes displays your hostname. The second box displays CPU usage by users and the system as percentages. The third gives you the current time and the uptime (how long the system has been up) of your system. The fourth box displays the load average of the machine in numbers rather than the graphical representation at the top of the display.
Several menu options can affect the display in the process window, as can the preferences and toolbar options.
When using the 'notebook' mode (see the MDI modes in the Preferences dialogue), this redraws the current process view as a new page of the notebook. When using the 'toplevel' mode, it draws it in a new window. When using the 'modal' mode, it draws it on top of the original display. (FIXME -- Check this. Needs better wording in any case.)
This opens a new window of gtop. If you have a low-end machine, you will see the load average increase sharply when you do this.
This leads to a further choice of options: Process usage, Memory usage, and Filesystem usage. These are described under other menu entries.
This closes the window. If it is the final or only window, gtop exits.
This exits gtop, closing the window(s).
'tty' is a common abbreviation for terminal. If 'tty processes' is checked, only those processes which run in a terminal are shown. This includes most processes started by users. Some processes, such as system daemons, do not get run in a terminal and so will be removed from the display whilst this box is checked.
If 'hide idle processes' is checked, only those processes in a state of 'R' (or running) are shown. This will often mean only the gtop process is visible on the display. This is a useful box to check if you think that one of your programs is 'eating CPU time' as it will show up more obviously here if this is the case.
If 'hide system processes' is checked, the processes which the system runs continually are not shown, largely cutting the display down to programs started by users.
If 'all processes' is checked, gtop displays information on all processes running on the machine. You will need to use the scrollbar to see all of them. Either this or the 'user processes' box must be checked.
If 'user processes' is checked, gtop displays information only on processes which were started as the result of commands by the user. (Note that some processes are still owned by 'root'; they are processes started by a command from the user, which root then runs for the user.) Either this or the 'all processes' button must be checked.
The Settings Menu gives access to the Preferences dialogue.
The Windows Menu provides a choice of which of gtop's three displays to show: Processes, Memory Usage, or Filesystems .
The Help Menu gives access to the About dialogue box for gtop's credits and to this manual.
There are two icons on the toolbar. The icon with a little clock and a tick or a cross by it is for 'start/stop sampling'. The default is that sampling is on and the display is being constantly updated. Switching it off will stop the display being updated. The notepaper icon invokes the Preferences dialogue for gtop.
There are three ways to alter the display of the different fields in the processes view.
You can remove or add entire fields from the display. To do this, use the Preferences dialogue.
You can alter the width of the different fields displayed. Move the pointer to the boundary between two fields, and it will change to a double-headed arrow and a vertical bar will appear. Drag this bar to where you want to resize the column. (POSSBUG: is this what's supposed to happen? I can move the line that appears but the display doesn't redraw and adjust.)
You can sort the display by each field so that processes with the highest or lowest value appear at the top of the display. Pick a column title and click on it with mouse button one (this is the left mouse button for most people, although some left-handers change this). Most columns have two alternative ways of sorting the display. For example, clicking a few times on the PID column title will switch between displaying the processes in ascending and descending order of their PID number. Clicking on Time will range them in order of which has used the most or least CPU time. Sorting by the different memory options can be interesting, but it can be very noticeable that some programs appear large by one measure and small by other measures. The only column which does not have a sorting facility in it is the Stat column.
Individual processes can be selected by clicking on them with mouse button one (which is the left mouse button for most people.) To deselect a process, either select a new one, or single-click on the one you want to deselect. Double-clicking on a selected process will produce a further display of information in a new window. This new window is the same as the window produced by the Details menu item described below.
Once a process has been selected, clicking with button two on that process produces a further menu. This gives the choice of Send... SIGTERM, Send... SIGKILL, Renice, Memory maps, or Details.
The list of SIG messages that you can send to that process is very long, but they are almost all ways of killing that process. Be sure you mean to kill it if you select anything beginning with SIG. Be doubly sure if you are running gtop as root. As root, you can kill processes belonging to other people, and you can kill processes that the machine needs. This is a bad idea.
SIGTERM is used to send the process a polite "please terminate and tidy up" signal. SIGKILL is used to send a process a less polite "die now" signal. If SIGTERM doesn't work to kill a process, then try SIGKILL.
Selecting renice brings up a dialogue box where you can alter the process's priority. 0 is normal. Only root can renice processes to negative numbers, which makes them less nice and gives them a higher priority. Anyone can slow their own processes down, however.
There are three forms of the memory map. The first, process info, displays the same information that the process display shows. The raw memory map shows all the addresses in memory that this process uses and that its shared libraries use. The graphical memory map is a graphical representation of the information in the raw memory map. This information is probably not something that most people will need (or want) to know.
The Details menu option brings up the same information that double-clicking with button 1 on the process line on the main display does. It appears in a very wide dialogue box, so people with small screens should beware. The only extra information not on the main process screen which is provided by this dialogue box are the WCPU on systems which support it (weighed CPU use, calculated slightly differently from CPU but a similar idea); and the process credentials: effective user ID (EUID), real user ID (RUID), effective group ID (EGID) and real group ID (RGID). These show whose permissions the process is running with. Some programs are invoked by the user but run with other permissions. For example, changing your password with the passwd command will result in an effective UID of root for that process, because only root can run the part of that program which changes the password.