What is htop and What Does It Do? [htop Command]

Want to have a better Unix system monitor? We recommend the use of htop command. What is htop? How to understand its output?

Updated: 17 Dec, 22 by Antoniy Yushkevych 8 Min

List of content you will read in this article:

There are many ways to monitor the processes happening on your Linux server. Today, we will showcase a useful system monitor named htop.

Htop is an interactive system monitor, process viewer, and process manager designed for Unix systems. Originally designed as an alternative to the Unix program top, it provides much of the same functionality as top, but offers much greater flexibility over how system processes can be viewed.

Unlike top, htop provides the full list of running processes instead of the top resource-consuming ones. Htop can display processes as a tree and uses color to provide resource-usage statistics.

Htop plays three primary roles:

  • System monitoring
  • Process viewing
  • Process management

Linux  Virtual Server
Linux Virtual Server

Starting From $5.99/Monthly

First and foremost, you need to install htop on your system. Here’s how you can do that:

  • Install htop in Linux:

sudo apt-get install htop

  • Install htop in Fedora:

sudo dnf install htop

  • Install htop in CentOS:

sudo yum install epel-release

sudo yum install htop

  • Install htop on Mac:

brew install htop

Now, run the htop command.


Here’s what the htop interface looks like:

Now, let’s see what each field means, starting at the top:


This parameter indicates how long the system has been running. The same information can be seen by running the uptime command. It reads the information from the /proc/uptime file.

Load Average

In addition to uptime, three numbers represent the load average. They are taken from the /proc/loadavg file. If you take another look at the strace output, you'll see that this file was also opened.

PID (Process ID)

Every time a new process is started, it is assigned an identification number (ID) called process ID or PID for short.

If you run a program in the background (&) from bash, you will see the job number in square brackets and the PID.

Process Tree

When you launch a new process, the process that launches the new process is called the parent process. The new process is now a child process for the parent process. These relationships form a tree structure. If you hit F5 in htop, you can see the process hierarchy. You can also use the f switch with ps or pstree.

Process User

A user owns each process. Users are represented with a numeric ID. The id command can be used to find out the name of the user. This command gets the information from the /etc/passwd and /etc/group files.

Process State (S)

While within htop it is denoted as only an “S”, it stands for process state. Here are the values you might encounter within it:

  • R: the process is currently running or on a run queue waiting to run.
  • S: the process is in interruptible sleep (waiting for an event or condition to happen).
  • D: the process is in uninterruptible sleep (cannot be woken up from sleep).
  • Z: the process is defunct (a.k.a. “zombie”). Terminated but not repeated by its parent.
  • T: the process is stopped by the job control signal.
  • t: the process is stopped by the debugger during the tracing.
  • X: the process is dead. You will probably never see this one.

Process Time

Linux is a multitasking operating system which means that even when you have a single CPU, you can run several processes simultaneously. You can connect to your server via SSH and look at the output of htop while your web server delivers your blog's content to your readers over the internet.

How is that possible when a single CPU can only execute one instruction at a time? The answer is time-sharing. One process runs for a bit. Then it is suspended while the other processes waiting to run take turns running for a while. The bit of time a process runs is called the time slice.

The time slice is usually a few milliseconds, so you don't really notice it that much when your system is not under a high load. (It'd be really interesting to find out how long time slices usually are in Linux.)

This should help explain why the load average is the average number of running processes. If you have just one core and the load average is 1.0, the CPU has been utilized at 100%. If the load average is higher than 1.0, it means that the number of processes wanting to run is higher than the CPU can run so you may experience slowdowns or delays. If the load is lower than 1.0, it means the CPU is sometimes idling and not doing anything.

This should also give you a clue why sometimes the running time of a process that's been running for 10 seconds is higher or lower than exactly 10 seconds.

Process Niceness and Priority

When you have more tasks to run than the number of available CPU cores, you somehow have to decide which tasks to run next and which ones to keep waiting. This is what the task scheduler is responsible for.

The scheduler in the Linux kernel is responsible for choosing which process on a run queue to pick next, and it depends on the scheduler algorithm used in the kernel.

You can't generally influence the scheduler, but you can let it know which processes are more important to you, and the scheduler may consider it.

Niceness (NI) is a user-space priority to processes, ranging from -20, the highest priority, to 19, the lowest priority. It can be confusing, but you can think that a nice process yields a less nice process. So the nicer a process is, the more it yields.

Memory Usage

A process has the illusion of being the only one in memory. This is accomplished by using virtual memory.

A process does not have direct access to physical memory. Instead, it has its own virtual address space, and the kernel translates the virtual memory addresses to physical memory or can map some of it to disk. This is why it can look like processes use more memory than you have installed on your computer.

The point I want to make here is that it is not very straightforward to figure out how much memory a process takes up. Do you also want to count the shared libraries or disk-mapped memory? But the kernel provides, and htop shows some information that can help you estimate memory usage.

Here is what the memory usage colors mean:

  • Green: Used memory
  • Blue: Buffers
  • Orange: Cache
  • -d –delay : Used to show the delay between updates in tenths of seconds.
  • -C –no-color –no-colour : Start htop in monochrome mode.
  • -h –help : Used to display the help message and exit.
  • -u –user=USERNAME : Used to show only the processes of a given user.
  • -p –pid=PID, PID… : Used to show only the given PIDs.
  • -s –sort-key COLUMN : Sort by this column (use –sort-key help for a column list).
  • -v –version : Output version information and exit
  • Arrows, Page Up, Page Down, Home, End: Scroll the process list.
  • Space: Tag or untag a process.
  • – Untag all processes (remove all tags added with the Space key).
  • – Trace process system calls.
  • F1 – Help
  • F2 – setup
  • F3 – search
  • F4 – filtering: type in part of a process command line, and only processes whose names match will be shown.
  • F5 – Tree view.

We hope that with the help of this detailed blog, you were able to better understand htop and learn how to use the program. If you have any questions or suggestions, please leave them in the comment section below.

People are also reading:

Antoniy Yushkevych

Antoniy Yushkevych

Master of word when it comes to technology, internet and privacy. I'm also your usual guy that always aims for the best result and takes a skateboard to work. If you need me, you will find me at the office's Counter-Strike championships on Fridays or at a.yushkevych@monovm.com