How does the top command works in linux? How its giving real time Output?

Question

I'm exploring how top command works and catch the information from the server and its presentation progressively. The following are my discoveries would you be able to please give some reasonable focuses to find out about this.

For Your Information:

I have run the top command in my first session and given the lsof -c top in another session. It's giving underneath yield

# lsof -c top
COMMAND   PID USER   FD   TYPE DEVICE  SIZE/OFF       NODE NAME
top     86597 root  cwd    DIR  253,0      4096   67149954 /root
top     86597 root  rtd    DIR  253,0      4096        128 /
top     86597 root  txt    REG  253,0    106944      10467 /usr/bin/top
top     86597 root  mem    REG  253,0     50744   33803265 /usr/lib64/libnuma.so.1
top     86597 root  mem    REG  253,0 106075056   33803109 /usr/lib/locale/locale-archive
top     86597 root  mem    REG  253,0     68192   33576550 /usr/lib64/libbz2.so.1.0.6
top     86597 root  mem    REG  253,0     90248   33588715 /usr/lib64/libz.so.1.2.7
top     86597 root  mem    REG  253,0    100008   33804478 /usr/lib64/libelf-0.172.so
top     86597 root  mem    REG  253,0    402384   33588705 /usr/lib64/libpcre.so.1.2.0
top     86597 root  mem    REG  253,0     19896   34975734 /usr/lib64/libattr.so.1.1.0
top     86597 root  mem    REG  253,0    141968   33804335 /usr/lib64/libpthread-2.17.so
top     86597 root  mem    REG  253,0     88776   33597070 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
top     86597 root  mem    REG  253,0    330464   33807284 /usr/lib64/libdw-0.172.so
top     86597 root  mem    REG  253,0    105824   33804337 /usr/lib64/libresolv-2.17.so
top     86597 root  mem    REG  253,0     19384   33576919 /usr/lib64/libgpg-error.so.0.10.0
top     86597 root  mem    REG  253,0    535064   33576927 /usr/lib64/libgcrypt.so.11.8.2
top     86597 root  mem    REG  253,0     85952   33906471 /usr/lib64/liblz4.so.1.7.5
top     86597 root  mem    REG  253,0    157400   33588725 /usr/lib64/liblzma.so.5.2.2
top     86597 root  mem    REG  253,0    155784   33804371 /usr/lib64/libselinux.so.1
top     86597 root  mem    REG  253,0     43776   33804347 /usr/lib64/librt-2.17.so
top     86597 root  mem    REG  253,0   1137016   33804038 /usr/lib64/libm-2.17.so
top     86597 root  mem    REG  253,0     20032   33577001 /usr/lib64/libcap.so.2.22
top     86597 root  mem    REG  253,0   2151672   33803924 /usr/lib64/libc-2.17.so
top     86597 root  mem    REG  253,0     19288   33804036 /usr/lib64/libdl-2.17.so
top     86597 root  mem    REG  253,0    174576   33990961 /usr/lib64/libtinfo.so.5.9
top     86597 root  mem    REG  253,0    163704   33990950 /usr/lib64/libncurses.so.5.9
top     86597 root  mem    REG  253,0    203800   33598907 /usr/lib64/libsystemd.so.0.6.0
top     86597 root  mem    REG  253,0     78840   33577018 /usr/lib64/libprocps.so.4.0.0
top     86597 root  mem    REG  253,0    163400   33803344 /usr/lib64/ld-2.17.so
top     86597 root  mem    REG  253,2    217032   50448935 /var/db/nscd/passwd
top     86597 root    0u   CHR  136,1       0t0          4 /dev/pts/1
top     86597 root    1u   CHR  136,1       0t0          4 /dev/pts/1
top     86597 root    2w   CHR    1,3       0t0       1040 /dev/null
top     86597 root    3u   CHR  136,1       0t0          4 /dev/pts/1
top     86597 root    4r   REG    0,3         0 4026532029 /proc/stat
top     86597 root    5r   REG    0,3         0 4026532030 /proc/uptime
top     86597 root    6r   REG    0,3         0 4026532028 /proc/meminfo
top     86597 root    7r   REG    0,3         0 4026532027 /proc/loadavg

Along these lines, when we enter the top command it's venturing out to these lib records lastly get the data from the /proc files and given the yield. My inquiry it's taken just stat, uptime, meminfo and loadavg files as it were. What about the process information and where it's capturing and how it shows the output of the process information. Could you please give me a more detail information on this?

Answer 1

The top(1) and ps(1) -and many others- commands are using /proc/ (thru the libprocfs library). Read proc(5). On Linux, /proc/ is the usual way to query the Linux kernel about its whole-system state.

The /proc/ file-system (called procfs) is "virtual", in the sense that the Linux kernel is lazily computing its content without fetching any data from the disk. Each process has a directory under /proc/ describing it. So /proc/1234/ describes the process of pid 1234.

You could mimic what ps does by directly reading the /proc/ directory (using opendir(3) readdir(3) closedir(3) stat(2) for directories and their entries, and open(2) read(2) close(2) for files etc...)

In practice, for pseudo-files such as /proc/vmstat, /proc/meminfo, or /proc/1234/maps, you'll better open, read, and close them quickly (practically speaking, that would happen in perhaps less than one millisecond). See also this and that answers.

You are asking:

How does the top command work on Linux?

BTW, the top command is free software. So please download its source code (and the source code of libprocps) then study it. I guess that top is scanning every second the /proc/ directory (but that is going so fast that you are unlikely to catch that directory scan, which your lsof command does not catch in practice).

You could use strace(1) to catch all the system calls (done by a command such as top), and then you'll see that directories like /proc/1234/ are opened, scanned, and closed so quickly by top that lsof -c top don't see them.