htop Command: Tutorial & Examples

If top is the live x-ray of your server, htop is the cockpit.

What It Is

htop is what top would look like if someone redesigned it today. It reads the exact same numbers out of /proc that top does — every process, every CPU core, the load average, the memory split — but it paints them in color, lets you scroll with the mouse, draws a real parent/child tree, and turns every common action into a function key. The numbers are identical; the ergonomics are a different decade.

If top is the page where you learn what a Linux machine is doing (start there — this page assumes you've read it), htop is the page where you learn to act on it without leaving the screen. You don't memorize the PID and run kill in another shell — you arrow down to the row and press F9. You don't pipe ps through grep to find a process — you press F3 and type. And — the part nobody discovers on their own — you can reshape the whole display to show exactly the meters you care about. htop is the rare Linux tool you can customize without editing config files.

Unlike top, htop is not installed by default on most distributions. One line fixes that — see Gotchas.

Your First Look

Type three letters:

htop

  1  [|||||||||||||                            32.4%]   Tasks: 142, 318 thr; 2 running
  2  [|||                                       7.1%]   Load average: 0.98 1.02 0.74
  3  [|||||||||||||||||||||||||||||||||||||||  99.8%]   Uptime: 9 days, 02:14:33
  4  [|                                         1.2%]
  Mem[|||||||||||||||||||||              4.71G/15.6G]
  Swp[                                       0K/2.0G]

  PID USER      PRI  NI VIRT    RES   SHR  S CPU% MEM%   TIME+  Command
 2323 mysql      20   0 19.8G  6.0G 11196 S 99.7 37.7 101:56.24 /usr/sbin/mysqld
 1576 root       20   0 1.9G   260M 35772 S  3.0  1.6   0:12.45 java -jar app.jar
 2746 www-data   20   0 568M    87M 20740 S  0.7  0.5   0:05.27 /usr/sbin/apache2
 ...
 F1Help  F2Setup  F3Search  F4Filter  F5Tree  F6SortBy  F7Nice- F8Nice+ F9Kill  F10Quit

Three regions, top to bottom: the meters (those colored bars at the top — one per CPU core plus memory and swap), the process list (everything running, scrollable, colorized), and the F-key bar at the bottom (every action is right there — no memorizing).

The colors inside the CPU bars mean something specific — they're the same us/sy/ni/wa/etc. buckets top shows as percentages on %Cpu(s), just rendered as colored segments inside the bar. Blue is low-priority (niced), green is your programs, red is kernel, orange-ish is I/O wait. The reading is the same; the encoding is the change.

How I Read It

Same first glance as top: load average vs core count, then a sweep across the CPU bars looking for wa (I/O wait) and the colors that say "the kernel is busier than your code." See the top page for the full mental model — it's all the same numbers.

What htop lets me do that top can't is two things, and they're why I keep it open instead.

First — the bar graphs make the single-threaded trap visible at a glance. With four cores on screen as four bars, I don't have to remember to press 1 (the way I do in top) — I just see "core 1 pinned at 99%, the other three flatlined." That pattern is one of the most common and most expensive mistakes in cloud computing: an app that uses one core, on a box you're paying for eight of. Same lesson as the top 1 trick, no keystroke required.

Second — I act on what I see, in place. Find a runaway? Arrow to its row, press F9, pick the signal. Need to lower a backup's priority? F7/F8 walk the nice value up and down. Looking for one program by name? F3 opens an incremental search; F4 filters the list down to matches. F5 redraws the whole list as a tree, so I can see who spawned whom. The mouse works too — click a column header to sort by it, click a row to select. None of this needs a PID.

Pro Tip

the single most-missed feature in htop is F2 — Setup. Press it once. You can add, remove, and rearrange the meters at the top: put the load average up there as a meter, add a clock, add the hostname, add Tasks, swap any CPU bar between text and graph styles. You can also choose which columns the process list shows (the column list goes on for pages — IO_READ_RATE, OOM, CGROUP, STARTTIME, threads, you name it). Most people use htop for a decade and never press F2 — and they miss htop's defining trick: it's the one common Linux tool you can reshape without touching a config file. Press F10 to save your layout to ~/.config/htop/htoprc.

The Sections, Explained

The meters (top region). By default, one bar per logical CPU (so a 16-thread machine shows 16 bars — and yes, those are logical CPUs, hyperthreads included; see the top page for what that means), plus Mem and Swp. On the right: Tasks, Load average, Uptime. Everything here is configurable via F2; you can add meters for I/O wait, network throughput, disk activity, battery, date, system temperature, and more. Meters come in four styles — Bar, Text, Graph (a small scrolling chart — the magic style), and LED — and you pick per meter.

The process list (middle region). Same data as ps aux or top, one row per process, refreshed live. Default sort is CPU% descending, so the biggest user is on top. You can:

Scroll vertically with the arrow keys, Page Up/Down, or mouse wheel — and the list is complete, not truncated to one screen the way top is. You can scroll to PID 1 (systemd) at the very top if you want.
Scroll horizontally with the left/right arrows to see the full command line without truncation.
Sort by any column with F6 (or click the header with the mouse).
Select a row with the arrow keys, then act on it with the F-keys.

The function-key bar (bottom region). Every action you'd ever want, labeled. Read it. Most veterans I know don't remember the key numbers — they read the bar.

The Keys, Explained

The interactive keys that matter. F-keys map to the labeled bar; letter keys are the top-compatible shortcuts.

F1 / h — help screen.
F2 / S — setup. Meters, columns, colors, display options. The hidden gem.
F3 / / — incremental search; type a name, jumps to the first match. n jumps to the next.
F4 / \ — filter; type a string and the list collapses to matching rows until you clear it with Esc. (Different from search: search highlights, filter hides everything else.)
F5 / t — tree view toggle. Draws parent/child indentation, so you see systemd → sshd → your login shell → your htop. When something is forking out of control, this is the view that shows you the family tree at the source. Press +/- to collapse and expand subtrees, or * to expand them all.
F6 / <, > — pick the sort column.
F7 / F8 — renice the selected process down/up one step.
F9 / k — kill; opens a signal picker (SIGTERM, SIGKILL, SIGHUP, …). No PID typing.
F10 / q — quit.
Space — tag a row (you can tag several, then F9 kills all of them at once).
U — untag all.
u — show only processes owned by a chosen user.
H — toggle showing kernel threads.
K — toggle showing user threads. (H and K together control what you see; turning them off makes the list shorter and saner.)
I — invert the sort order.
c — tag the process and all its children — pairs beautifully with F9.
l — open lsof on the selected process (shows every open file and socket).
s — open strace on the selected process (live system call trace). htop is a launcher.
a — set CPU affinity for the selected process.
F — follow the selected process as the list re-sorts (otherwise the row you wanted slides away when its %CPU changes).

Command-line flags (used at startup):

htop -d 50 — refresh every 5.0 seconds (the number is tenths of a second; default is 15).
htop -u alice — show only alice's processes from the start.
htop -p 2323,4711 — show only the given PIDs.
htop -s PERCENT_MEM — start sorted by a column (column names are the uppercase identifiers you see in F6).
htop -t / --tree — start in tree view (same as pressing F5 immediately).
htop -F nginx / --filter=nginx — start with the filter pre-applied.
htop -H / --highlight-changes — flash values that just changed; great for spotting movement.
htop -C / --no-color — monochrome.
htop -M / --no-mouse — disable mouse (so terminal text selection works normally for copy/paste).
htop --readonly — disable all process-affecting actions (no kill, no renice). Safe to leave open on a shared box.

Reading It by Example

Four CPU bars, one at 99%, three near 0%, total load around 1.0. The single-threaded trap, visible without pressing anything. Whatever's on top of the process list can only use one core; a bigger machine won't help. See the top page for the full lesson — htop just makes the diagnosis a glance instead of a key press.

All sixteen bars roughly even at 60-70%, load around 11, color is mostly green. A correctly-sized server doing real work, scaling across cores nicely. Healthy.

CPU bars mostly green, but one bar has a thick orange/red band and wa is climbing. I/O wait: the CPU is stalled waiting on disk or network. Switch to iostat to find which device.

Tree view (F5), and you find one gunicorn parent with 32 children all named gunicorn: worker. That's your web server's worker pool, exactly as configured. If you don't recognize the fan-out, that's how you find the misconfigured --workers 32 someone left in.

Tree view, and a single process keeps spawning new children that you didn't expect — the list grows every refresh. A runaway fork bomb or a buggy supervisor. Tag the parent with Space, press c to tag its children too, then F9 → SIGKILL.

A row in red, S column showing D. Uninterruptible sleep — the process is stuck in a kernel or disk call and you can't even kill it. See top's war story for what this often means in production.

Cheat Sheet

The minimum to be dangerous:

htop — launch.
F10 or q — quit. (The one everybody asks first.)
F2 — Setup. Reshape the meters and columns. Press this once in your life.
F3 — search by name; F4 — filter by name.
F5 — tree view (parent/child).
F6 — pick the sort column; I — invert.
F9 — kill the selected row, no PID needed.
F7 / F8 — renice down / up.
Space to tag, then F9 to kill them all.
u — filter by user; H / K — toggle kernel/user threads.
l / s — launch lsof / strace on the selected process.

Flags worth knowing: -d N (refresh in tenths of a second), -u USER, -p PID,PID, -s COLUMN, -t (start in tree), -F STRING (start with filter), --readonly (no destructive actions).

How You'll Actually Use It

Honestly: I open htop, look, and quit — exactly like top. The difference is the next step. If a row catches my eye, I act on it right there: F3 to find it again next time, F9 to kill it, F5 to see where it sits in the tree, F2 the first time on a new machine to put the load average and a network-throughput graph in the meters bar. After that the layout persists in ~/.config/htop/htoprc and the box feels yours.

What I never do is try to script against htop. It has no batch mode (the older -d snapshot trick you'll see in tutorials doesn't really exist) — it's interactive by design. For scripting, reach for ps; for a no-frills always-installed live view over SSH to a stripped-down box, top; for log-shaped output over time, vmstat or sar. htop is the eyes-on tool.

One real workflow worth stealing: in a tmux split, keep htop running in one pane while you deploy in the other. The instant something spikes, you see it — and you can act on it in the same window.

Gotchas

Not installed by default. sudo apt install htop on Debian/Ubuntu, sudo dnf install htop on Fedora/RHEL, sudo pacman -S htop on Arch. On a tiny rescue shell or a container you may only have top — fall back to that.
Without root, you see processes you can't act on. You can read everyone's rows but F9 on someone else's process will fail. Run sudo htop when you actually need to kill or renice.
Mouse mode steals text selection. With mouse mode on, dragging to copy text out of the terminal does nothing. Start with htop -M, or hold Shift while you drag (most terminal emulators pass the selection through when Shift is held).
CPU% is per-core, just like top. A row showing 780% means 7.8 cores worth, not "impossible." Not a bug.
VIRT is not real memory; read RES. Same trap as top, same answer.
Tree view changes sorting. When F5 (tree) is on, the sort column is ignored — the tree has its own order. Turn it off to sort by CPU% again.
F1, F2 sometimes hijacked by your terminal. GNOME Terminal and some tmux configs grab the function keys. Use the letter alternatives: h for help, S for setup, / for search, \ for filter, t for tree, k for kill, q for quit.

History & Philosophy

htop was written in 2004 by Hisham Muhammad, a Brazilian developer, as a personal project — he was a Linux user who liked top but felt it could be friendlier. The first releases were one-person work. Two decades later it's in every distribution's repository, ported to BSD and macOS, and the project lives at htop-dev/htop on GitHub with a small team of maintainers carrying it forward.

The design philosophy is right there in the layout: show more, hide nothing, let the user reshape it. top shows you what fits on one screen and crops the rest; htop lets you scroll. top shows the meters it decided you need; htop lets you pick. top expects you to memorize keys; htop labels them. None of this is technically hard — it's a few thousand lines of C on top of ncurses reading the same /proc files top reads — but it took someone deciding the UX was worth taking seriously. That's the lesson worth remembering: most beloved Linux tools aren't new ideas, they're old ideas with kinder edges.

And the same payoff applies as with top and ps: everything you see in htop is just files in /proc (/proc/loadavg, /proc/meminfo, /proc/stat, and /proc/<pid>/* for each row). htop isn't asking the kernel — it's reading. Once that lands, the box stops being a black box.