The top & htop command in Linux
top is the live system monitor present on every Linux machine: refreshing view of load, memory and the process table, sortable and interactive. htop is its friendlier successor — colors, scrolling, tree view, mouse — worth installing everywhere you work. Reading the header correctly (load average, memory line) is a core sysadmin literacy.
How top & htop works
top samples /proc on every refresh and displays deltas between samples — which is why its %CPU means "during the last interval" while ps shows a lifetime average, and the two disagree by design. The load average in the header counts processes runnable or in uninterruptible I/O wait, sampled over 1, 5 and 15 minutes: a queue length, not a percentage, meaningful only against your core count.
The memory line requires the same literacy: buff/cache is the kernel using idle RAM as disk cache, reclaimable on demand, and "avail Mem" is the honest headroom estimate. The %CPU state row diagnoses by category — high us is your code, high sy is kernel work, high wa is storage being the bottleneck, and st (steal) is a cloud hypervisor giving your "dedicated" CPU to a neighbor.
Syntax
top [OPTIONS] | htopCommon options
| Option | What it does |
|---|---|
P / M (keys) | Sort by CPU / by memory. |
k (key) | Kill a process from inside top (asks for PID and signal). |
1 (key) | Show each CPU core separately. |
-u USER | Only one user's processes. |
-b -n 1 | Batch mode: one snapshot to stdout — top for scripts. |
q | Quit. |
How to use top & htop: examples
$ topThe classic. Header: uptime, load average (1/5/15 min), task counts, CPU breakdown, memory.
$ htopSame data, humane interface: F6 sorts, F5 tree view, F9 kills, mouse works.
$ top -b -n 1 | head -20A snapshot for logs or scripts — non-interactive top.
$ top -u www-dataWatch only the web server's processes.
Real-world use cases for top & htop
The slow-server first response
Something is "slow": top, read the header first — load vs cores, then %CPU states. High us: profile the app. High wa: storage is drowning (find the writer with iotop). High st: your cloud neighbor is noisy; resize or move. The header routes the investigation before you look at any process.
Catching a leak in the act
Suspected memory leak: htop, F6 sort by MEM%, watch the suspect's RSS climb over minutes. Screenshot readings at intervals and you have the growth curve that turns a hunch into a bug report.
Pro tips and common mistakes
- Judge load average against nproc — 8.0 is an emergency on 2 cores and a nap on 32.
- Press 1 in top to unfold per-core view; one core pinned at 100% while others idle means a single-threaded bottleneck.
- Install htop everywhere you work; the tree view (F5) showing who spawned what has explained a thousand mysteries.
Frequently asked questions about top & htop
What is a "good" load average?
Rule of thumb: load ≈ number of CPU cores means fully busy. 4.0 on a 4-core box is saturation; on 16 cores it is idle capacity. Always read load against core count (nproc).
Why does Linux show almost no free memory?
Unused RAM is wasted RAM: the kernel fills it with disk cache, released instantly when programs need it. Read the "available" column, not "free".
What do the %CPU states mean?
us user code, sy kernel, wa waiting on disk I/O (high wa = storage bottleneck), st stolen by the hypervisor (noisy cloud neighbor).
Things people do with top & htop
See how much memory is really available, and which process is eating it.
Stop a process in LinuxFind a process, send it SIGTERM first, and use SIGKILL only when necessary.
List running processes in LinuxUse ps to inspect running processes, PIDs, users and commands.
Related commands
See what is running, find a process ID, and combine with grep to hunt down a program.
killTerminate processes politely or forcibly — and understand what -9 really does.
freeRAM and swap at a glance — and how to read "available" correctly.