Why use htop instead of top

htop shows the same information as top, but it is easier to read and to work with. You get colour bars for each CPU core, memory and swap, you can scroll through every process, search and filter by name or user, see parent and child processes in a tree, and stop or reprioritise a process without typing its PID.

Install htop

# AlmaLinux, Rocky Linux, CloudLinux, RHEL (from EPEL)
dnf install -y epel-release
dnf install -y htop

# Fedora
dnf install -y htop

# Debian and Ubuntu
apt update && apt install -y htop

# Arch Linux
pacman -S htop

# openSUSE
zypper install htop

# FreeBSD
pkg install htop

Check the version with htop --version. Current distributions ship htop 3.x.

Read the htop screen

The header

Compare the load average with the number of CPU cores. A load of 4 on a 4-core server means the CPUs are fully used. A load well above the core count means processes are waiting, often for disk or CPU.

The process columns

Keyboard shortcuts

Start htop with options

htop -u nobody        # only processes owned by one user
htop -p 1234,5678     # only these process IDs
htop -t               # start in tree view
htop -s PERCENT_MEM   # sort by memory
htop -d 50            # refresh every 5 seconds (delay in tenths of a second)

Find what is slowing a server down

1. Press P. If a few processes use most of the CPU, note the user and command.
2. Press M. If RES is high and swap is in use, the server is short of memory.
3. Look at the S column. Many processes in state D point to slow disk I/O rather than CPU.
4. On cPanel servers, check the USER column to see which hosting account owns the busy PHP or MySQL processes.
5. Press F5 to see which parent process started them, for example a cron job or a web server.

Stop a process safely

Select the process, press F9, and choose a signal. Try 15 SIGTERM first: it asks the program to exit cleanly and save its work. Use 9 SIGKILL only if the process does not respond, because it stops the process at once. Do not kill system services such as sshd, mysqld or httpd from htop. Restart them with systemctl restart instead.

For ongoing monitoring with alerts and history, see our guide to real-time Linux server monitoring.