top & htop Cheatsheet - Process Monitoring & Load
Load Average on top is the first number everyone reads and the least reliable one. It counts tasks that are runnable or in uninterruptible sleep, so a process wedged on disk shows up as "busy" even when the CPU sits idle. Judge load by correlating three things: the %us and %sy split, the process column re-sorted by CPU, and the presence of D-state entries that point at storage rather than compute. This sheet covers interactive sort keys (P, M, %CPU, %MEM), the fields worth watching in the memory and swap lines, and batch usage such as top -b -n1 for a single sample and top -H for per-thread views, which makes it possible to diff two snapshots instead of eyeballing a moving screen. An htop section sits alongside for tree views, filtering and key-driven navigation. When the question is a slow trend rather than a slow minute, cross-check with vmstat or pidstat rather than refreshing.
Typical Use Case
For operators and developers who need to answer "what is this machine stuck on" quickly. The trap in top is that load average lies: high load with high CPU idle usually means disk or network IO is blocking rather than the CPU being short, while processes piling up in D state (uninterruptible sleep) mean storage is already overloaded — those cannot even be kill -9 until IO returns. This sheet puts interactive sort keys, batch flags and the criteria for reading each key indicator together, so it also works for scripted health checks.
top Basics 6
toptop -d 5top -p 1234top -u usernametop -n 10top -b -n 1 > top.logtop Interactive 8
h / ?qSpacekrnsWtop Sort & Display 10
MPTNcHi1fohtop Basics 5
htophtop -d 5htop -u usernamehtop --no-colorhtop --treehtop Interactive 17
F1 / h / ?F2 / SF3 / /F4 / \F5 / tF6 / >F7 / [F8 / ]F9 / kF10 / qSpaceUcHKptLoad Average 6
1 min / 5 min / 15 min> CPU corestasks: total / running / sleeping / stopped / zombie%Cpu(s): us / sy / ni / id / wa / hi / si / stMiB Mem: total / free / used / buff/cacheMiB Swap: total / free / usedParameter matrix
| Parameter | Effect | Example |
|---|---|---|
top -b -n 1 | Batch output of a single frame, easy to pipe or script. | top -b -n 1 | head -20 |
top -p <pid> | Monitor only the specified process. | top -p 3120 -d 2 |
top -u <user> | Show only one user's processes. | top -u tom |
top -d <n> | Set the refresh interval (seconds). | top -d 2 |
P / M / T / N | Interactive sorting: CPU / memory / time / PID. | Press M after entering top |
top -o %MEM | Batch mode can also sort by memory. | top -b -n 1 -o %MEM |
k | Kill a process (enter the PID, no second confirmation). | Press k in top, then enter the PID |
c | Toggle display of the full command-line path. | Press c in top |
htop | Colorful interactive alternative with mouse and filtering support. | htop --tree |
1-minute / 5-minute / 15-minute | The three load average values, meaningful only when compared with the core count. | Compare against the nproc result |
tasks line | running / sleeping / zombie process counts. | Watch the zombie count |
%Cpu(s) line | us user / sy system / id idle / wa IO wait. | High wa indicates IO blocking |
Common pitfalls
Symptomload average is high but CPU usage is low.
Causeload counts "runnable + uninterruptible" tasks; disk or network IO blocking puts processes into D state while the CPU sits idle.
FixCheck whether wa (IO wait) in %Cpu(s) is high, and inspect the tasks line for many D-state processes.
Symptomfree memory looks very low and you suspect a shortage.
CauseLinux uses idle memory for page cache (buff/cache), which can be reclaimed at any time.
FixLook at the available column; also check whether swap is being read and written continuously—only when both are strained is there real pressure.
SymptomKilling a critical process by accident after pressing k in top.
Causek sends the signal immediately with no second confirmation.
FixDouble-check before entering the PID; in critical environments record the PID first so you can recover.
SymptomThe instantaneous data collected is inaccurate, with runs differing widely.
Causetop refreshes every 3 seconds by default, so a single frame is a sampling instant rather than a stable value.
FixFor scripted collection use top -b -n 1 for a single frame, or -d 1 to shorten the interval and take multiple frames to judge the trend.
SymptomA large number of zombie processes (Z state) cannot be cleared.
CauseThe parent of a zombie process has died; zombies must be reaped by the parent.
FixFind the PPID and restart the parent process; killing the child does nothing.
Symptomswap is constantly being read and written, yet system memory looks sufficient.
CauseActive memory beyond the page cache has exceeded physical memory, or a high vm.swappiness setting causes premature swap-out.
FixFirst use free -h to look at available rather than free; determine whether swapping is continuous or momentary—momentary swapping is normal reclamation behavior.
Troubleshooting
1Take one frame of output for scripted checks.
top -b -n 1 | head -3Batch mode outputs once without refreshing, so you can grep the metric lines directly for threshold checks.
2See what is eating memory.
top -b -n 1 -o %MEM | head -12-o lets batch mode sort too, without entering the interactive UI.
3Watch a single process's fluctuation.
top -p 3120 -d 2-d 2 lowers the refresh to 2 seconds, better suited than the default for watching bursty usage.
4Confirm the CPU core count to judge whether load is too high.
nprocA load average is meaningful only against the core count; reading the absolute value alone leads to misjudgment.
5Switch to htop when you need a mouse and filtering.
htop --treeIt supports click-to-sort, F4 filtering, and a tree view of parent/child processes—more intuitive for multi-process investigations.
Command Examples
Watch the 10 most CPU-hungry processes
top -b -n 1 | head -20-b is batch mode: no refresh, output once; -n 1 means run one round then exit—so you can pipe it or write it into a script. In interactive top, pressing P also sorts by CPU.
Output
%Cpu(s): 12.5 us, 3.1 sy, 84.4 id, 0.0 wa Tasks: 231 total, 1 running, 230 sleeping %Cpu PID COMMAND 48.2 3120 node 21.7 980 postgres
Monitor a single PID
top -p 3120 -d 2-d 2 sets the refresh interval to 2 seconds, better than the default 3 seconds for watching bursty usage. When locating "which process eats memory", the interactive M key sorts by memory faster.
Output
%Cpu(s): 5.1 us, 1.0 sy, 93.9 id PID USER PR VIRT RES SHR S %CPU %MEM 3120 user 20 1.2g 318m 22m S 48.2 8.1
Sort by memory to find the heaviest consumer
top -b -n 1 -o %MEM | head -12-o %MEM lets batch mode sort too, without entering the interactive UI. One command gets the result for a quick check, which suits putting into a script better than entering top and pressing M.
Output
%Cpu PID COMMAND 18.2 1452 chrome 12.7 2031 electron 9.4 3120 node
Common Pitfalls
- Load average only means something relative to your core count; high load with idle CPU usually indicates disk or network IO blocking, not insufficient CPU.
- D-state (uninterruptible sleep) processes are waiting on kernel IO and cannot be killed until it returns; an accumulation points to a storage bottleneck rather than a reason to restart the app.
- top refreshes every 3 seconds by default, which distorts instantaneous readings; use top -b -n 1 for a single frame.
- A low free value is not out-of-memory — Linux uses idle memory for page cache. Judge by available and by whether swap is actively churning.
- Pressing k in top sends the signal immediately with no second confirmation; verify the PID first.
Tips
- top ships with the system; htop needs install but is friendlier and more powerful.
- Load average above the core count means overload — investigate high-load processes.
- High wa (IO wait) means disk bottleneck; high hi/si (interrupts) means network/hardware issues.
FAQ
How high is too high for load average?
The threshold is not an absolute number, it is relative to your core count: if the 1, 5 and 15 minute values stay above the number of cores, work is queuing. In top also check the running and zombie counts on the tasks line and the us value under %Cpu(s). Load high while CPU sits idle usually means disk or network IO is blocking, not that you need more CPU.
What does a D-state process mean in top?
D is uninterruptible sleep: the process is waiting for kernel-level IO, usually a disk or network read/write that has stalled. It matters more than R (running) because a D-state process cannot even be killed with kill -9 until the IO returns. If D-state processes keep accumulating, your storage or network is overloaded, and restarting the application rarely helps — investigate the IO bottleneck first.
top or htop — which should I use?
top ships with the system and needs no install, which makes it the safest choice in scripts or on a bare SSH box. htop requires installing but adds mouse-click sorting, a process tree for parent-child relationships, and F4 filtering, which is far more intuitive for multi-process debugging. Key bindings differ too: in top, P sorts by CPU and M by memory; htop uses F6 or clicking the column header.
Why does memory usage in top differ from what free reports?
Linux uses idle memory for page cache, so a low free alongside high buff/cache does not mean you are out of memory — that cache can be reclaimed at any time. Look at the available column instead, and check whether swap is being actively read and written. Only when available is also low and swap is churning is it real memory pressure.
How do I filter top to a single user's processes?
Two ways: start with top -u username to scope it from the beginning — if the first column comes out blank, double-check the spelling. Or launch top and press u then Enter to type the username interactively. To watch one specific process, use top -p 1234, which is far quicker than scrolling to find it.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us