Updated 8 hours ago
Something's wrong with your system. It's slow, or unresponsive, or the fans are screaming. The first question: what's consuming all the resources?
top and htop answer that question in real time. They show every running process, how much CPU and memory each consumes, and what the system is doing overall. This is where troubleshooting begins.
The Two Tools
top comes preinstalled on virtually every Unix system. It's spartan but universal:
htop is the modern, friendlier version with colors, mouse support, and easier navigation. Install it if you haven't:
Both show the same fundamental information. Use htop when available, fall back to top when you're on a minimal system.
Reading the Display
The screen divides into two parts: system summary at the top, process list below.
System Summary
Load averages appear as three numbers (1-minute, 5-minute, 15-minute). These represent how many processes want CPU time. The catch: interpretation depends on your CPU cores.
Check your core count:
On a 4-core system:
- Load 1.0 means 25% utilized
- Load 4.0 means fully utilized
- Load 8.0 means processes are waiting in line
Load average is the only metric where bigger numbers mean worse things, but the threshold depends entirely on how many CPU cores you have. A load of 8.0 is a crisis on a dual-core laptop and a light Tuesday on a 16-core server.
Compare the three numbers to see trends: if the 1-minute average exceeds the 15-minute average, load is increasing. If it's lower, things are calming down.
CPU breakdown shows where time goes:
- us (user): Applications doing work
- sy (system): Kernel operations
- wa (wait): Waiting for disk or network I/O
- id (idle): Nothing to do
High wa is the smoking gun for I/O bottlenecks—your disk or network can't keep up. High sy with low us suggests the kernel is doing heavy lifting (often network stack processing). High us means your applications are computing.
Memory shows total, used, free, buffers, and cached. Here's the counterintuitive part: high cached memory is good. Linux uses spare RAM to cache files, speeding up disk access. This memory releases instantly when applications need it. True memory pressure shows as high swap usage.
Process List
Each row is a process. The columns that matter most:
| Column | Meaning |
|---|---|
| PID | Process ID (use this to kill or investigate) |
| USER | Who owns it |
| %CPU | CPU consumption |
| %MEM | Memory consumption |
| RES | Actual RAM used (more meaningful than VIRT) |
| S | State (R=running, S=sleeping, D=stuck on I/O, Z=zombie) |
| COMMAND | What's running |
Ignore VIRT (virtual memory)—it includes memory that isn't actually in RAM. RES tells you what a process actually consumes.
Process States Tell Stories
R (running): Actively executing or ready to execute. Normal.
S (sleeping): Waiting for something to happen (user input, timer, network data). Most processes spend most of their time here. Normal.
D (uninterruptible sleep): Waiting for I/O to complete. The "d" might as well stand for "don't even try to kill me"—these processes are waiting for hardware to respond, and no signal will interrupt that conversation. A process stuck in D state for minutes usually indicates disk problems, unreachable network filesystems, or hardware issues. Check dmesg for errors.
Z (zombie): Finished executing but the parent process hasn't acknowledged the exit. Zombies consume almost nothing (just a process table entry). A few are normal. Many zombies mean the parent process is buggy—kill the parent to clean them up.
Navigating and Sorting
In top:
P— Sort by CPU usage (default)M— Sort by memory usageu— Filter by usernamed— Change update intervalq— Quit
In htop:
- Arrow keys to navigate
F3— Search for a processF4— Filter by nameF5— Tree view (shows parent-child relationships)F6— Choose sort columnF9— Send signal (kill, terminate, stop)F10orq— Quit
htop's tree view reveals which processes spawned which—useful for understanding why something is running and what depends on it.
Common Scenarios
One Process Eating All CPU
Might be legitimate (video encoding, compilation, data processing) or problematic (infinite loop, runaway script). Check what the process is and whether it should be doing heavy work right now.
High I/O Wait, Low CPU Usage
The system waits for disk or network. Processes might show D state. Check for:
- Slow or failing disks (
dmesgfor errors) - Network filesystems on unreachable servers
- Database queries hitting disk constantly
Memory Nearly Full, System Still Fast
Probably fine. Check if "cached" memory is high—that's Linux using RAM productively. Only worry if swap usage is high and climbing.
Memory Full, High Swap Usage
Actual memory pressure. Swap is disk-backed virtual memory, orders of magnitude slower than RAM. Find the memory hog (sort by %MEM) and decide whether to kill it, add RAM, or tune the application.
Load Average Climbing Steadily
Gradual increases suggest growing traffic, memory leaks causing swapping, or processes accumulating. Sudden spikes suggest batch jobs starting, traffic surges, or attacks.
Monitoring Specific Processes
Watch just one process in top:
In htop, search (F3) or filter (F4) to focus on specific applications.
What These Tools Don't Show
top and htop don't show network bandwidth per process. A process saturating your network connection might show low CPU and minimal memory usage. For network attribution, use nethogs or iftop.
They also don't show disk I/O per process directly. Use iotop for that.
Going Deeper
Once you've identified a suspicious process with top or htop, investigate further:
lsof -p [PID]— What files and network connections does it have open?strace -p [PID]— What system calls is it making right now?ls -la /proc/[PID]/— Detailed process informationps aux | grep [name]— More process details and relationships
The workflow: use top/htop to spot the problem, then specialized tools to understand it.
Frequently Asked Questions About top and htop
Was this page helpful?