+370 5 205 5502 sales@monovm.com

What is htop and What Does It Do?

Want to have a better Unix system monitor? We recommend the use of htop. What is htop? How to understand it's output? That and more you will learn from this article.

30 Aug, 21 by Antoniy Yushkevych 8 min Read

List of content you will read in this article:

There are many ways to monitor the processes happening on your Linux server. Today, we will showcase a useful system monitor named htop.


Htop is an interactive system monitor, process viewer, and process manager designed for Unix systems. Originally designed as an alternative to the Unix program top, it provides much of the same functionality as top, but offers much greater flexibility over how system processes can be viewed.

Unlike top, htop provides the full list of running processes instead of the top resource-consuming ones. Htop can display processes as a tree and uses color to provide resource-usage statistics.

Htop plays three primary roles:

  • System monitoring
  • Process viewing
  • Process management


First and foremost, you need to install htop on your system. Here’s how you can do that:

  • Linux:

sudo apt-get install htop

  • Linux (Fedora):

sudo dnf install htop

  • Linux (CentOS):

sudo yum install epel-release

sudo yum install htop

  • Mac:

brew install htop

Now, run the htop command.


Here’s how the htop interface looks like:

Now, let’s see what each field means, starting at the top:


This parameter indicates how long the system has been running. The same information can be seen by running the uptime command. It reads the information from the /proc/uptime file.

Load Average

In addition to uptime, there were also three numbers that represent the load average. They are taken from the /proc/loadavg file. If you take another look at the strace output, you'll see that this file was also opened.

PID (Process ID)

Every time a new process is started it is assigned an identification number (ID) which is called process ID or PID for short.

If you run a program in the background (&) from bash, you will see the job number in square brackets and the PID.

Process Tree

When you launch a new process, the process that launched the new process is called the parent process. The new process is now a child process for the parent process. These relationships form a tree structure. If you hit F5 in htop, you can see the process hierarchy. You can also use the f switch with ps or pstree.

Process User

Each process is owned by a user. Users are represented with a numeric ID. The id command can be used to find out the name of the user. This command gets the information from the /etc/passwd and /etc/group files.

Process State (S)

While within htop it is denoted as only an “S”, it stands for process state. Here are the values you might encounter within it:

  • R: the process is currently running or on a run que waiting to run.
  • S: the process is in interruptible sleep (waiting for an event or condition to happen).
  • D: the process in in uninterruptible sleep (cannot be waken up from sleep).
  • Z: the process is a defunct process (a.k.a. “zombie”). Terminated but not repeated by its parent.
  • T: the process is stopped by job control signal.
  • t: the process is stopped by debugger during the tracing.
  • X: the process is dead. You will probably never see this one.

Process Time

Linux is a multitasking operating system which means that even when you have a single CPU, you can run several processes at the same time. You can connect to your server via SSH and look at the output of htop while your web server is delivering the content of your blog to your readers over the internet.

How is that possible when a single CPU can only execute one instruction at a time? The answer is time-sharing. One process runs for a bit of time, then it is suspended while the other processes waiting to run take turns running for a while. The bit of time a process runs is called the time slice.

The time slice is usually a few milliseconds so you don't really notice it that much when your system is not under high load. (It'd be really interesting to find out how long time slices usually are in Linux.)

This should help explain why the load average is the average number of running processes. If you have just one core and the load average is 1.0, the CPU has been utilized at 100%. If the load average is higher than 1.0, it means that the number of processes wanting to run is higher than the CPU can run so you may experience slowdowns or delays. If the load is lower than 1.0, it means the CPU is sometimes idling and not doing anything.

This should also give you a clue why sometimes the running time of a process that's been running for 10 seconds is higher or lower than exactly 10 seconds.

Process Niceness and Priority

When you have more tasks to run than the number of available CPU cores, you somehow have to decide which tasks to run next and which ones to keep waiting. This is what the task scheduler is responsible for.

The scheduler in the Linux kernel is responsible for choosing which process on a run queue to pick next and it depends on the scheduler algorithm used in the kernel.

You can't generally influence the scheduler but you can let it know which processes are more important to you and the scheduler may take it into account.

Niceness (NI) is a user-space priority to processes, ranging from -20 which is the highest priority to 19 which is the lowest priority. It can be confusing but you can think that a nice process yields to a less nice process. So the nicer a process is, the more it yields.

Memory Usage

A process has the illusion of being the only one in memory. This is accomplished by using virtual memory.

A process does not have direct access to physical memory. Instead, it has its own virtual address space and the kernel translates the virtual memory addresses to physical memory or can map some of it to disk. This is why it can look like processes use more memory than you have installed on your computer.

The point I want to make here is that it is not very straightforward to figure out how much memory a process takes up. Do you also want to count the shared libraries or disk-mapped memory? But the kernel provides and htop shows some information that can help you estimate memory usage.

Here is what the memory usage colors mean:

  • Green: Used memory
  • Blue: Buffers
  • Orange: Cache


  • -d –delay : Used to show the delay between updates, in tenths of seconds.
  • -C –no-color –no-colour : Start htop in monochrome mode.
  • -h –help : Used to display the help message and exit.
  • -u –user=USERNAME : Used to show only the processes of a given user.
  • -p –pid=PID, PID… : Used to show only the given PIDs.
  • -s –sort-key COLUMN : Sort by this column (use –sort-key help for a column list).
  • -v –version : Output version information and exit


  • Arrows, Page Up, Page Down, Home, End: Scroll the process list.
  • Space: Tag or untag a process.
  • – Untag all processes (remove all tags added with the Space key).
  • – Trace process system calls.
  • F1 – Help
  • F2 – setup
  • F3 – search
  • F4 – filtering: type in part of a process command line and only processes whose names match will be shown.
  • F5 – Tree view.


We hope that with the help of this detailed blog, you were able to better understand about htop and learn how to use the program. If you have any questions or suggestions, please leave them in the comment section below.

Antoniy Yushkevych

Master of word when it comes to technology, internet and privacy. I'm also your usual guy that always aims for the best result and takes a skateboard to work. If you need me, you will find me at the office's Counter-Strike championships on Fridays or at a.yushkevych@monovm.com