What htop shows that top does not
htop is an interactive process viewer for Linux. It draws one row per process with CPU, memory, state and command, sorts on a keypress, scrolls with the mouse, and shows the process tree without restarting.
Install it with sudo apt install htop on Ubuntu or Debian, or sudo dnf install htop on RHEL, AlmaLinux and Rocky. Many VPS images already carry it. Run htop as your normal user; you need root only to signal another user's processes, so set up a sudo user on Ubuntu rather than logging in as root.
- top redraws a fixed screen. htop scrolls and lets you click a row.
- top needs flags to sort. htop uses F6 or Shift+P, Shift+M and Shift+T.
- top shows a thread list by default on some builds. htop groups threads unless you press H to show them.
The process columns, one by one
The header meters are only half the story. These are the columns that decide what you do next.
| Column | What it means | When it matters |
|---|---|---|
| PID | Process ID, the number you pass to kill | Every action you take |
| USER | Owner of the process | Filtering to www-data or mysql |
| PRI / NI | Kernel priority and the nice value you can adjust | Lowering a backup's priority instead of killing it |
| VIRT | Virtual memory requested, including shared libraries and reserved space | Almost never. A high VIRT is normal. |
| RES | Resident memory actually held in RAM | The real memory number for a leak |
| SHR | Memory shared with other processes | Explaining why RES sums past total RAM |
| S | State: R running, S sleeping, D uninterruptible IO wait, Z zombie, T stopped | Telling a busy process from a blocked one |
| CPU% | Share of one core, so 200% means two full cores | Finding the process that saturates the box |
| MEM% | Share of total RAM held as RES | Finding the leak |
| TIME+ | Total CPU time consumed since start | A process with days of CPU time that should have finished |
Load average is not a column. It sits in the header as three numbers for the last 1, 5 and 15 minutes. Divide by your core count: 1.0 per core is fully busy, 2.0 per core means work is queueing.
Key bindings worth memorising
htop labels every function key at the bottom of the screen, so nothing here is hidden. These are the ones used in a real incident.
| Key | Action | Use it to |
|---|---|---|
| F3 or / | Search by name | Jump to a process you already suspect |
| F4 or \ | Filter the list | Show only php-fpm, mysql or node rows |
| F5 or t | Tree view | Find the parent before killing a child |
| F6 | Choose a sort column | Sort by CPU%, PERCENT_MEM or TIME+ |
| Shift+P / Shift+M / Shift+T | Quick sort by CPU, memory, time | One-key triage in each pass |
| F7 / F8 | Decrease or increase nice | Slow a backup instead of killing it |
| F9 or k | Send a signal | Kill or terminate the selected process |
| u | Filter by user | Show only www-data or only root |
| H | Toggle user threads | Stop one PHP process appearing as 30 rows |
| F2 | Setup | Add the IO read and write columns |
| F10 or q | Quit | Leave without signalling anything |
How to spot a runaway process
A runaway process is one whose demand keeps growing while its work does not finish. Four signals, in the order they appear.
- Load climbs above the core count and stays there for 15 minutes. A 2-core box at load 6 is queueing, not working.
- One row holds CPU% at or above 100 for minutes. Press Shift+P: if the top row never changes, that is the process.
- RES grows every refresh on the same PID. That is a leak, and it will end in the OOM killer unless you restart the service.
- Many rows of the same command sit at 90% CPU. That is a worker storm, usually PHP-FPM or Node, and the parent pool is the thing to slow down.
A process in D state at high CPU is waiting on disk, not computing. Killing it will not work until the IO returns; check for a full disk or a failing volume first.
The safe kill sequence
Kill in order, and stop as soon as the load drops. SIGTERM asks the process to finish and exit; SIGKILL removes it without cleanup, which can leave a database mid-write.
- Press F5 and find the parent. Killing the parent service is cleaner than killing twenty children.
- Prefer the service manager:
sudo systemctl stop php8.2-fpmorsudo systemctl restart mysqlhandles children and restarts cleanly. - If you must signal one PID, select it and press F9. Choose SIGTERM (15) first, then Enter.
- Wait 15 to 30 seconds and watch whether the row disappears. A process that ignores SIGTERM is stuck or trapping the signal.
- Only then press F9 again and choose SIGKILL (9). Note the PID and the command in your ticket before you do.
- Never kill PID 1, kthreadd, or a database during a write burst. Stop the service, or wait for the write to finish.
If the process is in D state, SIGKILL will leave it in the list until the IO completes. The fix is the disk, not another signal.
A five-minute triage on a slow VPS
Work top to bottom and stop when you find the cause. This sequence answers most slow-server tickets faster than reading logs.
- Read load average against core count. If load is under the core count, the problem is probably not CPU.
- Shift+P and look at the top three rows. Write down the command and PID.
- Shift+M. If memory is the pressure and swap is filling, the top row is your candidate.
- F4 and type
php, thenmysql, thennode. Count how many rows each name returns. - F5 to see whether the load comes from one request or from a queue with no worker limit.
- Act once: restart the service, renice the backup, or raise the worker limit. Then watch load for five minutes.
When htop says the server is too small
If load stays above the core count after you fix the top process, the box is undersized for the traffic. A 2 vCPU server running PHP-FPM, MySQL and a control panel will queue during any traffic spike, and no amount of tuning changes the arithmetic.
WebJi® VPS hosting and the Linux VPS line start at ₹5,900 per month before 18% GST for 2 vCPU, 8 GB RAM and 100 GB storage, with Linux images you can size up without a rebuild. Moving a site is free subject to terms and approval; email support@webji.services with the output of htop and free -m and the sizing can be checked before you pay.
Frequently Asked Questions
What does htop show?
A live list of every process with its owner, CPU share, resident memory, state and total CPU time, plus header meters for load average, memory and swap. It updates every second and accepts key commands without restarting.
What is the difference between VIRT, RES and SHR in htop?
VIRT is the address space a process reserved, including shared libraries and memory it may never touch. RES is what it actually holds in RAM. SHR is the part shared with other processes, such as common libraries.
How do I kill a process in htop?
Select the row and press F9, choose SIGTERM, and press Enter. If the row is still there after 30 seconds, press F9 again and choose SIGKILL. Stop the parent service first when it exists.
Why is load average higher than my CPU core count?
Load counts processes that are running and processes waiting for CPU or disk. Above one per core, work is queueing. A high load with low CPU use usually means disk wait, not a busy processor.
What does the D state mean in htop?
Uninterruptible sleep, almost always waiting on storage or a network filesystem. The process cannot be killed until the IO returns, so check disk space, disk health and mounted volumes before sending another signal.
Is htop better than top?
For interactive troubleshooting, yes: sorting, filtering, the tree view and mouse support save time. top is installed everywhere and is easier to script, so keep both.