The top & htop command in Linux
top is the live system monitor present on every Linux machine: refreshing view of load, memory and the process table, sortable and interactive. htop is its friendlier successor — colors, scrolling, tree view, mouse — worth installing everywhere you work. Reading the header correctly (load average, memory line) is a core sysadmin literacy.
How top & htop works
top samples /proc on every refresh and displays deltas between samples — which is why its %CPU means "during the last interval" while ps shows a lifetime average, and the two disagree by design. The load average in the header counts processes runnable or in uninterruptible I/O wait, sampled over 1, 5 and 15 minutes: a queue length, not a percentage, meaningful only against your core count.
The memory line requires the same literacy: buff/cache is the kernel using idle RAM as disk cache, reclaimable on demand, and "avail Mem" is the honest headroom estimate. The %CPU state row diagnoses by category — high us is your code, high sy is kernel work, high wa is storage being the bottleneck, and st (steal) is a cloud hypervisor giving your "dedicated" CPU to a neighbor.
Syntax
top [OPTIONS] | htopCommon options
| Option | What it does |
|---|---|
P / M (keys) | Sort by CPU / by memory. |
k (key) | Kill a process from inside top (asks for PID and signal). |
1 (key) | Show each CPU core separately. |
-u USER | Only one user's processes. |
-b -n 1 | Batch mode: one snapshot to stdout — top for scripts. |
q | Quit. |
How to use top & htop: examples
$ topThe classic. Header: uptime, load average (1/5/15 min), task counts, CPU breakdown, memory.
$ htopSame data, humane interface: F6 sorts, F5 tree view, F9 kills, mouse works.
$ top -b -n 1 | head -20A snapshot for logs or scripts — non-interactive top.
$ top -u www-dataWatch only the web server's processes.
Real-world use cases for top & htop
The slow-server first response
Something is "slow": top, read the header first — load vs cores, then %CPU states. High us: profile the app. High wa: storage is drowning (find the writer with iotop). High st: your cloud neighbor is noisy; resize or move. The header routes the investigation before you look at any process.
Catching a leak in the act
Suspected memory leak: htop, F6 sort by MEM%, watch the suspect's RSS climb over minutes. Screenshot readings at intervals and you have the growth curve that turns a hunch into a bug report.
Pro tips and common mistakes
- Judge load average against nproc — 8.0 is an emergency on 2 cores and a nap on 32.
- Press 1 in top to unfold per-core view; one core pinned at 100% while others idle means a single-threaded bottleneck.
- Install htop everywhere you work; the tree view (F5) showing who spawned what has explained a thousand mysteries.
Frequently asked questions about top & htop
What is a "good" load average?
Rule of thumb: load ≈ number of CPU cores means fully busy. 4.0 on a 4-core box is saturation; on 16 cores it is idle capacity. Always read load against core count (nproc).
Why does Linux show almost no free memory?
Unused RAM is wasted RAM: the kernel fills it with disk cache, released instantly when programs need it. Read the "available" column, not "free".
What do the %CPU states mean?
us user code, sy kernel, wa waiting on disk I/O (high wa = storage bottleneck), st stolen by the hypervisor (noisy cloud neighbor).
Related commands
See what is running, find a process ID, and combine with grep to hunt down a program.
killTerminate processes politely or forcibly — and understand what -9 really does.
freeRAM and swap at a glance — and how to read "available" correctly.