top & htop Cheatsheet - Process Monitoring & Load
Load Average on top is the first number everyone reads and the least reliable one. It counts tasks that are runnable or in uninterruptible sleep, so a process wedged on disk shows up as "busy" even when the CPU sits idle. Judge load by correlating three things: the %us and %sy split, the process column re-sorted by CPU, and the presence of D-state entries that point at storage rather than compute. This sheet covers interactive sort keys (P, M, %CPU, %MEM), the fields worth watching in the memory and swap lines, and batch usage such as top -b -n1 for a single sample and top -H for per-thread views, which makes it possible to diff two snapshots instead of eyeballing a moving screen. An htop section sits alongside for tree views, filtering and key-driven navigation. When the question is a slow trend rather than a slow minute, cross-check with vmstat or pidstat rather than refreshing.
Typical Use Case
For operators and developers who need to answer "what is this machine stuck on" quickly. The trap in top is that load average lies: high load with high CPU idle usually means disk or network IO is blocking rather than the CPU being short, while processes piling up in D state (uninterruptible sleep) mean storage is already overloaded — those cannot even be kill -9 until IO returns. This sheet puts interactive sort keys, batch flags and the criteria for reading each key indicator together, so it also works for scripted health checks.
top Basics 6
toptop -d 5top -p 1234top -u usernametop -n 10top -b -n 1 > top.logtop Interactive 8
h / ?qSpacekrnsWtop Sort & Display 10
MPTNcHi1fohtop Basics 5
htophtop -d 5htop -u usernamehtop --no-colorhtop --treehtop Interactive 17
F1 / h / ?F2 / SF3 / /F4 / \F5 / tF6 / >F7 / [F8 / ]F9 / kF10 / qSpaceUcHKptLoad Average 6
1 min / 5 min / 15 min> CPU corestasks: total / running / sleeping / stopped / zombie%Cpu(s): us / sy / ni / id / wa / hi / si / stMiB Mem: total / free / used / buff/cacheMiB Swap: total / free / usedParameter matrix
| Parameter | Effect | Example |
|---|---|---|
top -b -n 1 | 批处理输出单帧，便于接管道或写脚本 | top -b -n 1 | head -20 |
top -p <pid> | 只监控指定进程 | top -p 3120 -d 2 |
top -u <user> | 只看某用户的进程 | top -u tom |
top -d <n> | 设置刷新间隔（秒） | top -d 2 |
P / M / T / N | 交互排序：CPU / 内存 / 时间 / PID | 进入 top 后按 M |
top -o %MEM | 批处理模式也能按内存排序 | top -b -n 1 -o %MEM |
k | 杀进程（输入 PID，无二次确认） | top 中按 k 后输 PID |
c | 切换显示完整命令行路径 | top 中按 c |
htop | 彩色交互式替代，支持鼠标与过滤 | htop --tree |
1分钟/5分钟/15分钟 | load average 三个值，与核心数比较才有意义 | 与 nproc 结果对比 |
tasks 行 | running / sleeping / zombie 进程计数 | 关注 zombie 数 |
%Cpu(s) 行 | us 用户 / sy 系统 / id 空闲 / wa IO 等待 | wa 高说明 IO 阻塞 |
Common pitfalls
Symptomload average 很高但 CPU 使用率却很低。
Causeload 统计的是「可运行 + 不可中断」任务，磁盘或网络 IO 阻塞会让进程进入 D 状态而 CPU 空闲。
Fix看 %Cpu(s) 里的 wa（IO 等待）是否高，并检查 tasks 行是否有大量 D 状态进程。
Symptom内存 free 很低，怀疑内存不足。
CauseLinux 把空闲内存用于页缓存（buff/cache），这部分可随时回收。
Fix看 available 那一列；同时检查 swap 是否在持续读写，只有两者都告急才是真压力。
Symptomtop 里按 k 误杀了关键进程。
Causek 立即发送信号且无二次确认。
Fix输入 PID 前再次确认；关键环境先记录 PID 以便恢复。
Symptom采到的瞬时数据不准，几次运行结果差很多。
Causetop 默认每 3 秒刷新，单帧是采样瞬间而非稳定值。
Fix脚本采集用 top -b -n 1 取单帧，或用 -d 1 缩短间隔取多帧判断趋势。
Symptom大量僵尸进程（Z 状态）无法清除。
Cause僵尸进程的父进程已死，需要由父进程回收。
Fix找到 PPID 并重启父进程；kill 子进程无效。
Symptomswap 一直在读写，但系统内存看起来还够用。
Cause页面缓存之外的活跃内存已超出物理内存，或 vm.swappiness 设置偏高导致过早换出。
Fix先用 free -h 看 available 而非 free；确认换页是持续还是瞬时，瞬时换页属正常回收行为。
Troubleshooting
1取一帧输出做脚本判断
top -b -n 1 | head -3批处理不刷新只输出一次，可直接 grep 指标行做阈值判断。
2看谁在吃内存
top -b -n 1 -o %MEM | head -12-o 让批处理也能排序，不用进交互界面。
3盯住单个进程的波动
top -p 3120 -d 2-d 2 把刷新降到 2 秒，比默认更适合盯突发占用。
4确认 CPU 核数以判断 load 是否过高
nprocload 平均值必须与核数比较才有意义，单看绝对值会误判。
5需要鼠标与过滤时换 htop
htop --tree支持点击排序、F4 过滤、树形看父子进程，多进程排查更直观。
Command Examples
Watch the 10 most CPU-hungry processes
top -b -n 1 | head -20-b 批处理模式不刷新、只输出一次，-n 1 表示跑一轮就退出——这样能直接接管道或写进脚本。交互式 top 里按 P 也是按 CPU 排序。
Output
%Cpu(s): 12.5 us, 3.1 sy, 84.4 id, 0.0 wa Tasks: 231 total, 1 running, 230 sleeping %Cpu PID COMMAND 48.2 3120 node 21.7 980 postgres
Monitor a single PID
top -p 3120 -d 2-d 2 把刷新间隔设为 2 秒，比默认的 3 秒更适合盯突发占用。定位「哪个进程吃内存」时配合交互模式的 M 键按内存排序更快。
Output
%Cpu(s): 5.1 us, 1.0 sy, 93.9 id PID USER PR VIRT RES SHR S %CPU %MEM 3120 user 20 1.2g 318m 22m S 48.2 8.1
Sort by memory to find the heaviest consumer
top -b -n 1 -o %MEM | head -12-o %MEM 让批处理模式也能排序，不用进交互界面。临时排查一行命令即可拿到结果，比进 top 再按 M 更适合写进脚本。
Output
%Cpu PID COMMAND 18.2 1452 chrome 12.7 2031 electron 9.4 3120 node
Common Pitfalls
- Load average only means something relative to your core count; high load with idle CPU usually indicates disk or network IO blocking, not insufficient CPU.
- D-state (uninterruptible sleep) processes are waiting on kernel IO and cannot be killed until it returns; an accumulation points to a storage bottleneck rather than a reason to restart the app.
- top refreshes every 3 seconds by default, which distorts instantaneous readings; use top -b -n 1 for a single frame.
- A low free value is not out-of-memory — Linux uses idle memory for page cache. Judge by available and by whether swap is actively churning.
- Pressing k in top sends the signal immediately with no second confirmation; verify the PID first.
Tips
- top ships with the system; htop needs install but is friendlier and more powerful.
- Load average above the core count means overload — investigate high-load processes.
- High wa (IO wait) means disk bottleneck; high hi/si (interrupts) means network/hardware issues.
FAQ
How high is too high for load average?
The threshold is not an absolute number, it is relative to your core count: if the 1, 5 and 15 minute values stay above the number of cores, work is queuing. In top also check the running and zombie counts on the tasks line and the us value under %Cpu(s). Load high while CPU sits idle usually means disk or network IO is blocking, not that you need more CPU.
What does a D-state process mean in top?
D is uninterruptible sleep: the process is waiting for kernel-level IO, usually a disk or network read/write that has stalled. It matters more than R (running) because a D-state process cannot even be killed with kill -9 until the IO returns. If D-state processes keep accumulating, your storage or network is overloaded, and restarting the application rarely helps — investigate the IO bottleneck first.
top or htop — which should I use?
top ships with the system and needs no install, which makes it the safest choice in scripts or on a bare SSH box. htop requires installing but adds mouse-click sorting, a process tree for parent-child relationships, and F4 filtering, which is far more intuitive for multi-process debugging. Key bindings differ too: in top, P sorts by CPU and M by memory; htop uses F6 or clicking the column header.
Why does memory usage in top differ from what free reports?
Linux uses idle memory for page cache, so a low free alongside high buff/cache does not mean you are out of memory — that cache can be reclaimed at any time. Look at the available column instead, and check whether swap is being actively read and written. Only when available is also low and swap is churning is it real memory pressure.
How do I filter top to a single user's processes?
Two ways: start with top -u username to scope it from the beginning — if the first column comes out blank, double-check the spelling. Or launch top and press u then Enter to type the username interactively. To watch one specific process, use top -p 1234, which is far quicker than scrolling to find it.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us