htop Command Explained
htop is an interactive process viewer for Linux: a live table of every process with CPU, memory and state, plus function-key shortcuts. Open it with htop, press F6 to sort by CPU or PERCENT_MEM, F4 to filter a name, F5 for the process tree, and F9 to send SIGTERM before SIGKILL.
For VPS admins who inherited a slow box: read the columns, learn the eight keys that matter, and stop processes in the safe order.
knowledge
- Read time
- 5 min
- Sections
- 6
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What does htop show that top does not?
htop is an interactive process viewer for Linux: one live row per process with CPU, memory, state and command, sorted on a keypress, scrolled with the mouse, and switched to a tree view without restarting. top redraws a fixed screen and needs flags or interactive commands to sort; htop makes all of that a single key.
Install it with sudo apt install htop on Ubuntu or Debian, or sudo dnf install htop on RHEL, AlmaLinux and Rocky — many VPS images already carry it. Run htop as your normal user; root is only needed to signal another user's processes, so set up a sudo user on Ubuntu instead of logging in as root. In htop's defaults, CPU% is a share of one core, so 200% means two full cores busy.
- top redraws a fixed screen; htop scrolls and lets you click a row.
- top needs flags to sort; htop uses F6, or Shift+P / Shift+M / Shift+T for one-key sorts.
- htop groups user threads by default — press H when you need them listed separately.
What does each process column mean?
The header meters are half the story — the columns decide what you do next: PID identifies the process, RES is the real memory number, S tells you whether it is computing or blocked, and CPU% finds the process saturating the box.
| Column | What it means | When it matters |
|---|---|---|
| PID | Process ID — the number you pass to kill | Every action you take |
| USER | Owner of the process | Filtering to www-data or mysql |
| PRI / NI | Kernel priority and the nice value you can adjust | Lowering a backup's priority instead of killing it |
| VIRT | Virtual memory requested, including libraries and reserved space | Almost never — a high VIRT is normal |
| RES | Resident memory actually held in RAM | The real number for spotting a leak |
| SHR | Memory shared with other processes | Explaining why RES sums past total RAM |
| S | State: R running, S sleeping, D uninterruptible IO wait, Z zombie, T stopped | Telling a busy process from a blocked one |
| CPU% | Share of one core (200% = two cores) | Finding the saturating process |
| MEM% | Share of total RAM held as RES | Confirming the leak |
| TIME+ | Total CPU time consumed since start | A job with days of CPU time that should have finished |
Load average is not a column: it sits in the header as three numbers covering the last 1, 5 and 15 minutes. Divide by your core count — 1.0 per core means fully busy, and above that, work is queueing. Load counts processes running and waiting, so high load with low CPU% usually means disk wait.
Which keys do the actual work?
Eight keys cover daily triage: F3 to search, F4 to filter, F5 for the tree, F6 to choose the sort column, F7/F8 to change priority, F9 to signal a process, and u or H to narrow the view. All of them work while the screen keeps refreshing.
| Key | Action | Use it to |
|---|---|---|
| F3 or / | Incremental search by name | Jump to a process you already suspect |
| F4 or \ | Filter the list (case-insensitive) | Show only php-fpm, mysql or node rows |
| F5 or t | Tree view | Find the parent before touching a child |
| F6 | Choose the sort column | Sort by CPU%, PERCENT_MEM or TIME+ |
| Shift+P / Shift+M / Shift+T | Quick sort by CPU, memory, time | One-key triage in each pass |
| F7 / F8 | Raise priority (superuser) / lower priority | Slow a backup instead of killing it |
| F9 or k | Send a signal | Terminate the selected process |
| u | Filter by user | Show only www-data, or only root |
| H | Toggle user threads | Stop one PHP master appearing as 30 rows |
| F2 | Setup | Add the IO read/write columns to the display |
| F10 or q | Quit | Leave without signalling anything |
How do you spot a runaway process?
A runaway process is one whose demand keeps growing while its work never finishes, and it announces itself in four signals: sustained load above the core count, one row pinned at high CPU%, RES climbing on the same PID, or a storm of identical workers.
- Load climbs above the core count and stays for 15 minutes. A 2-core box at load 6 is queueing, not working.
- One row holds CPU% at or above 100 for minutes. Press Shift+P — if the top row never changes between refreshes, that is the process.
- RES grows every refresh on the same PID. That is a leak, and it ends at the OOM killer unless the service is restarted.
- Many rows of one command sit near 90% CPU. That is a worker storm — usually PHP-FPM or Node — and the parent pool is the thing to slow.
A process in D state is waiting on storage, not computing, so killing it achieves nothing until the IO returns. Check for a full disk or a failing volume first — the disk cleanup guide covers that half of the diagnosis.
What is the safe kill sequence in htop?
Kill in order and stop as soon as load drops: find the parent with F5, prefer the service manager over a manual signal, send SIGTERM with F9 and wait, and reach SIGKILL only after the process has ignored a clean terminate. SIGTERM asks the process to finish and exit; SIGKILL removes it without cleanup, which can leave a database mid-write.
- Press F5 and find the parent. Stopping the parent service is cleaner than killing twenty children one by one.
- Prefer systemd:
sudo systemctl stop php8.2-fpmorsudo systemctl restart mysqlhandles children and restarts cleanly. - If one PID must be signalled, select the row, press F9, choose SIGTERM (15), press Enter.
- Wait 15–30 seconds. A row that survives SIGTERM is stuck or trapping the signal.
- Only then F9 again and choose SIGKILL (9), noting the PID and command for the ticket before you do.
Never kill PID 1 or kthreadd, and never kill a database mid-write burst — stop the service or wait out the write. In D state even SIGKILL leaves the row listed until the IO completes; the fix is the disk, not another signal.
What does a five-minute triage on a slow VPS look like?
Work top to bottom and stop when you find the cause — this sequence answers most slow-server tickets faster than reading logs. One act per pass, then watch load for five minutes before changing anything else.
- Read load average against the core count. Under the core count, the problem is probably not CPU.
- Shift+P: write down the command and PID of the top three rows.
- Shift+M: if memory is the pressure and swap is filling, the top row is the candidate.
- F4, then type php, mysql, node in turn — count how many rows each name returns.
- F5 to see whether the load is one request or a queue with no worker limit.
- Act once: restart the service, renice the backup, or raise the worker ceiling.
When does htop tell you the server is too small?
When load stays above the core count after the top process is fixed, the box is undersized for the traffic — a 2 vCPU server running PHP-FPM, MySQL and a control panel will queue during any spike, and no tuning changes that arithmetic. Pair the htop reading with free -m before concluding.
The upgrade path is a VPS — from ₹499 a month before 18% GST, with the exact configuration scoped and quoted — or managed cloud at ₹5,900 a month for 2 vCPU on the Linux VPS line's cloud tier. Email support@webji.services with the output of htop and free -m and the sizing can be checked before you pay; support answers 24/7 in Hindi and English, average first reply under 60 minutes. For panel-specific context, the cPanel-on-VPS guide shows what the control stack itself costs in RAM.
Frequently asked questions
What is the difference between VIRT, RES and SHR in htop?
VIRT is the address space a process reserved, including shared libraries and memory it may never touch — a large VIRT is normal. RES is what it actually holds in RAM, the number that matters for a leak. SHR is the portion shared with other processes, which is why the RES column can appear to sum past total RAM.
How do I kill a process in htop?
Select the row, press F9, choose SIGTERM and press Enter. If the row is still there after 30 seconds, press F9 again and choose SIGKILL. When a parent service exists, stop that with systemctl instead — it is cleaner than signalling children individually.
Why is load average higher than my CPU core count?
Load counts processes that are running and processes waiting for CPU or disk. Above one per core, work is queueing. High load with low CPU% usually means disk wait rather than a busy processor — check the S column for D-state processes before blaming the CPU.
What does the D state mean in htop?
Uninterruptible sleep, almost always waiting on storage or a network filesystem. The process cannot be killed until that IO returns, so check disk space, disk health and mounted volumes before sending another signal — the disk cleanup guide is the usual next stop.
Is htop better than top?
For interactive troubleshooting, yes — sorting, filtering, tree view and mouse support save real time. top is installed everywhere and is easier to script in batch mode, so keep both: htop for the investigation, top for pipelines.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.