htop Process Viewer

htop cheatsheet — monitor CPU, memory, processes interactively. F6 to sort, F4 to filter, F9 to kill, F5 for tree view. Keyboard shortcuts for Linux process management.

5 min read

What it is

An interactive process viewer that displays real-time system resource usage and process information, useful for monitoring system performance and managing running processes.

Installation

Linux

sudo apt update && sudo apt install htop
# or
sudo yum install htop
# or
sudo dnf install htop

macOS

brew install htop

Windows

htop is not natively available on Windows. You can use the Windows Subsystem for Linux (WSL) to install and run htop.

  1. Install WSL: Follow Microsoft’s official guide.
  2. Open your WSL distribution (e.g., Ubuntu).
  3. Install htop within WSL:
    sudo apt update && sudo apt install htop

Core Concepts

  • Process Tree: htop displays processes in a tree-like structure, showing parent-child relationships, which helps in understanding process dependencies.
  • Resource Meters: At the top, visual meters display CPU usage per core, memory usage (RAM and Swap), and Load Average.
  • Process List: The main area lists individual processes with details like PID, User, Priority, Nice value, Virtual and Resident memory, State, CPU%, and Command.
  • Interactive Commands: htop allows direct interaction with processes (killing, renicing) via keyboard shortcuts.

Commands / Usage

htop is primarily interactive. The following are common keyboard shortcuts and actions:

  • Up/Down Arrow Keys: Move selection up/down.
  • Page Up/Page Down: Scroll up/down one page.
  • Home/End: Jump to the top/bottom of the list.
  • Left/Right Arrow Keys: Scroll the displayed columns horizontally.
  • ] (Close bracket): Collapse a process tree branch.
  • [ (Open bracket): Expand a process tree branch.

Sorting and Filtering

  • F6 or >: Open the sort options menu. Select a column (e.g., CPU%, MEM%) to sort by.
  • \ (Backslash): Enter filter mode. Type a string (e.g., nginx, user:root) to show only matching processes. Press Esc to clear the filter.
  • u: Filter by user. Prompts for a username. Press Esc to clear.
  • F4 or \: (Same as \) Enter filter mode.

Process Management

  • F2 or S: Open the setup menu. Customize displayed columns, meters, and color schemes.
  • F3 or /: Search for a process by name. Type the name and press Enter. Press F3 again to find the next occurrence. Press Esc to clear the search.
  • F9 or k: Kill a selected process. Prompts for a signal (default is SIGTERM). Common signals:
    • SIGTERM (15): Graceful termination request.
    • SIGKILL (9): Forceful termination.
    • SIGINT (2): Interrupt from keyboard (like Ctrl+C).
  • F7 or ]: Decrease the priority (increase nice value) of the selected process.
  • F8 or [: Increase the priority (decrease nice value) of the selected process.

Display Options

  • F5 or t: Toggle tree view on/off.
  • F10 or q: Quit htop.
  • H: Hide/show user threads.
  • K: Hide/show kernel threads.
  • M: Sort by memory usage.
  • P: Sort by CPU usage.
  • T: Sort by time/runtime.
  • F: Tag a process. Useful for applying actions to multiple processes.
  • U: Untag all tagged processes.
  • I: Invert sort order.
  • l: Show open file descriptors for the selected process.
  • s: Trace the system calls of the selected process (requires strace to be installed).
  • f: Go to the filter input.
  • a: Show process details (like arguments).
  • e: Show environment variables for the selected process.

Setup Menu (F2 or S)

  • Meters: Configure which resource meters are displayed at the top (CPU, Memory, Swap, Load Average, Network, Disk I/O).
  • Display Options: Configure overall display behavior (Tree view, Hide userland threads, Color scheme).
  • Columns: Add, remove, or reorder the columns displayed in the process list. Common columns include:
    • PID: Process ID.
    • USER: Owner of the process.
    • PRI: Priority.
    • NI: Nice value.
    • VIRT: Virtual memory size.
    • RES: Resident memory size.
    • SHR: Shared memory size.
    • S: Process State (R: Running, S: Sleeping, D: Disk Sleep, Z: Zombie, T: Stopped/Traced).
    • CPU%: Percentage of CPU time used.
    • MEM%: Percentage of physical RAM used.
    • TIME+: Total CPU time used by the process.
    • COMMAND: The command that started the process.

Common Patterns

  • Quickly find and kill a runaway process:

    1. Run htop.
    2. Press F6 and select CPU%.
    3. Press F3 and type the name of the suspected process (e.g., python).
    4. Use arrow keys to select the process.
    5. Press F9 and Enter to send SIGTERM. If it doesn’t stop, repeat with SIGKILL (type 9 then Enter).

  • Check memory hogs:

    1. Run htop.
    2. Press F6 and select MEM%.
    3. Observe the processes at the top of the list.

  • View processes for a specific user:

    1. Run htop.
    2. Press u.
    3. Type the username (e.g., www-data) and press Enter.

  • See if a specific service is running:

    1. Run htop.
    2. Press \ (backslash).
    3. Type the service name (e.g., sshd) and press Enter.

  • Monitor CPU usage per core:

    1. Run htop.
    2. Observe the CPU meters at the top, which show usage for each CPU core individually.

Gotchas

  • Permissions: To kill or renice processes owned by other users (especially root), you’ll need to run htop as root (sudo htop).
  • SIGKILL is brutal: SIGKILL (signal 9) cannot be caught or ignored by a process. Use it as a last resort, as it prevents the process from cleaning up properly, potentially leading to data corruption.
  • Threads vs. Processes: By default, htop often shows individual threads. You can toggle thread visibility with the H key (Hide/show user threads) to simplify the view if needed.
  • Interpreting Process States:
    • R (Running): The process is currently executing on a CPU or is ready to run.
    • S (Sleeping): The process is waiting for an event (e.g., I/O completion, a signal). This is the most common state for idle processes.
    • D (Uninterruptible Sleep): The process is waiting for I/O, often disk I/O. It cannot be killed easily, and if it hangs here, it might indicate a hardware or driver issue.
    • Z (Zombie): The process has terminated, but its parent process hasn’t yet collected its exit status. Usually harmless and short-lived, but a persistent zombie can indicate a problem with the parent process.
    • T (Stopped/Traced): The process has been stopped, usually by a signal (like SIGSTOP) or while being debugged.
  • Resource Usage Fluctuations: CPU and Memory percentages are snapshots in time. For sustained usage, observe trends over a few seconds or minutes. High CPU usage isn’t always bad; it might indicate the process is doing exactly what it’s supposed to. High idle CPU usage or consistently high memory usage for processes you don’t expect can be problematic.