How to Use the ‘htop’ and ‘top’ Commands for Interactive Process Monitoring

The Need for Real-Time Telemetry

The standard ps aux command is incredibly powerful, but it has a fatal flaw: it is static. It takes a single snapshot of the server’s RAM and CPU at the exact millisecond you hit enter. If a process spikes to 100% CPU two seconds later, you won’t see it unless you run the command again.

When a server is actively under heavy load or being attacked, administrators need a live, continuously updating dashboard. For this, Linux relies on the legacy top command, and its modern, highly visual successor, htop.

1. The Classic Standard (top)

Every single UNIX and Linux system on the planet comes with top installed by default. If you SSH into a completely barren, stripped-down Docker container, top will be there.

top

When you run it, the terminal transforms into an interactive matrix. The top half shows global system metrics (Uptime, Total Users, Load Average, Total RAM). The bottom half shows a live, shifting list of running processes.

Controlling top

Because it is a live interface, you don’t use standard flags. You use keyboard shortcuts while it is running:

• Press P (capital P) to sort the list by CPU usage (highest at the top).
• Press M (capital M) to sort the list by Memory usage.
• Press k to kill a process. It will pause and ask you to type the PID you want to terminate.
• Press q to quit and return to the normal terminal.

2. The Modern Upgrade (htop)

While top is universal, it is notoriously ugly and difficult to read quickly. Modern systems engineers almost exclusively install and use htop instead.

sudo apt install htop
htop

htop brings a massive quality-of-life upgrade to the terminal. Instead of raw numbers for CPU and RAM, it draws beautiful, color-coded bar graphs at the top of the screen. If you have a 16-core server, it will draw 16 distinct horizontal bars, allowing you to instantly see if a single core is maxed out while the others are idle.

3. Advanced htop Navigation

Unlike legacy top, htop allows you to scroll horizontally and vertically using the arrow keys. You can visually explore the entire process tree without relying on complex search commands.

It also features a persistent menu at the absolute bottom of the screen, tied to your Function keys (F1-F10).

• F3 (Search): Instantly highlights a specific application by name.
• F4 (Filter): Hides all processes except the one you type, clearing the noise from the screen.
• F5 (Tree View): This is the most powerful feature. It reorganizes the list to show the parent-child hierarchy. If a web server spawns 50 worker processes, Tree View visually connects them all, showing you exactly which master process owns them.
• F9 (Kill): Brings up a menu allowing you to send specific termination signals (like SIGTERM or SIGKILL) to the currently highlighted process.

Conclusion

While ps is perfect for automated scripts, top and htop are the ultimate tools for human troubleshooting. By providing a live, interactive window into the kernel’s resource allocation, they allow administrators to monitor, diagnose, and resolve severe server bottlenecks in real-time.