How to show CPU time for processes via top without 'root' procs

Question

Okay, So I've been attempting this for about three hours now without success.

How do you search/display/use the top command (or ps command if it works...) to output a list of all procs, sorted by CPU time Excluding procs owned by 'root'.

My attempts so far:

top -b -S -n 1 | grep -v root
top -b -S -n 1 | egrep -ve root

ps -eo pid,user,args,etime,time,%cpu --sort etime | egrep -v root

That and various attempts at running top in batch mode, outputting to a file and attempting to awk/grep/sort through it and sort it properly by the amount of CPU time (mostly unable to find the right column / manage to sort the right column in any seemingly useful way).

Forgive me if that seems a bit of a muddle; tl;dr:

I just want some way to easily read top without root procs and sorted by CPU time.

Solution 1

Your ps command should work if you sort it properly. From man ps:

   --sort spec
          Specify sorting order.  Sorting syntax is
          [+|-]key[,[+|-]key[,...]].  Choose a multi-letter key from the
          STANDARD FORMAT SPECIFIERS section.  The "+" is optional since
          default direction is increasing numerical or lexicographic
          order.  Identical to k.  For example: ps jax --sort=uid,-ppid,
          +pid

I'm not sure which time you want to sort by but here are the relevant choices:

STANDARD FORMAT SPECIFIERS
   bsdtime     TIME      accumulated cpu time, user + system.  The display
                         format is usually "MMM:SS", but can be shifted to
                         the right if the process used more than 999
                         minutes of cpu time.

   cputime     TIME      cumulative CPU time, "[DD-]hh:mm:ss" format.
                         (alias time).
   etime       ELAPSED   elapsed time since the process was started, in
                         the form [[DD-]hh:]mm:ss.

   etimes      ELAPSED   elapsed time since the process was started, in
                         seconds.

I think from your question that you want cputime. If so, this should give you your desired output:

ps -eo pid,user,args,etime,time,%cpu --sort cputime | grep -v root

Solution 2

If you want to simply exclude a user from showing up in top you can use the -u switch. It's not obvious at first but if you dig into the man page of top you'll notice that this switch can also be negated to act as an exclude list of users.

However, you'll need to make sure you have an appropriate version of top that can do this:

$ top -version
  procps-ng version 3.3.8

excerpt from top's man page

   -u | -U  :User-filter-mode as:  -u | -U number or name
        Display only processes with a user id or user name matching that 
        given.  The '-u' option matches on  effective user whereas  the  
        '-U' option matches on any user (real, effective, saved, or 
        filesystem).

        Prepending  an  exclamation  point ('!') to the user id or name 
        instucts top to display only processes with users not matching the 
        one provided.

Example

In the command below we're excluding the user root. It's critical that you escape the exclamation point (!) with a slash (\).

$ top -u\!root

     

Comments

[nom]

It works but how do I then list it by TIME+? The problem with using it in batch mode is that I can't use the interactive commands to list by CPU time.

[nom]

A very elegant solution! Sod's law that of course the server I'm on doesn't have a new enough version of top (and I probably wouldn't be allowed to update it either).

[slm]

@nom - what distro and version do you have?

[nom]

v 3.2.8 and Debian GNU/Linux 6.0 \n \l

[bsd]

@nom, if you can install, try htop as well. It has many features not found in top.

[nom]

@bdowning it's a work server so I won't be installing/updating anything at all tbh

[nom]

Eurika! Worked perfectly and gave me exactly the info I needed, thank you! :D

[Auspex]

Trust me to fail to read the "It's critical that you escape the exclamation point" warning. It turns out not to be critical--you can single-quote it ;-)