Short answer: install htop with dnf install htop (from EPEL) or apt install htop. The bars at the top show each CPU core and memory, and the load average should be compared with the number of cores. Look at the RES column for real memory use; VIRT is mostly reserved address space. Press F6 to change the sort, P or M to sort by CPU or memory, F4 to filter, F5 for the process tree, u to pick one user and F9 to send a signal. htop shows only the present moment. To see what happened at 3 a.m., use atop or sar logs.
Applies to htop 3.3.0 (EPEL 9) on AlmaLinux 9.8 with cPanel 138; Debian 12 ships 3.2.2; upstream 3.5 (May 2026); lab test 11 Oct 2026
We checked everything on this page with htop 3.3.0 from EPEL on our cPanel lab (AlmaLinux 9.8, 4 cores, 3.8 GB RAM) on 11 October 2026. Debian 12 ships htop 3.2.2; the newest upstream release is 3.5 (May 2026), which adds a backtrace screen and new meters. Colours and a few keys can differ between versions, so press F1 in your htop for its own legend.
Table of Contents
Install htop
# AlmaLinux / Rocky / CloudLinux (htop is in EPEL)
dnf install epel-release && dnf install htop
# Debian / Ubuntu
apt install htop
htop --versionhtop was already installed on our cPanel lab. It uses about 5 MB of memory and around 2% of one core at the default refresh of 1.5 seconds.
The header: CPU, memory, tasks and load
| Meter | What it means | When to worry |
|---|---|---|
| CPU bars (one per core) | How busy each core is. Colours split the time: by default green is normal user processes, red is kernel time and blue is low-priority (niced) work. With “detailed CPU time” on (F2 → Display options) you also see I/O wait and steal | All cores near 100% for minutes, a lot of red (kernel), or steal time on a VPS (the host is overloaded) |
| Mem | Used memory. Buffers and cache are shown in other colours and are given back when programs need them | Used (not cache) near the total while swap grows |
| Swp | Swap in use | Swap use that keeps growing, together with a high load: the server is short of RAM |
| Tasks | Processes, threads and how many are running right now | Thousands of tasks from one user (a fork bomb or runaway cron) |
| Load average | The average number of processes running or waiting, over 1, 5 and 15 minutes | Above the number of cores for a long time |
| Uptime | Time since the last boot | A recent reboot nobody planned |
Load average against cores: our lab has 4 cores (nproc), so a load of 4.0 means fully busy and 8.0 means half the work is waiting. On Linux, processes waiting for disk (state D) also count towards the load, so a high load with idle CPU bars usually means slow storage, not a CPU problem.
The columns
| Column | Meaning |
|---|---|
| PID | Process ID; use it with kill, lsof -p or strace -p |
| USER | Owner. On cPanel and DirectAdmin, PHP processes run as the site’s account, so this tells you which customer is busy |
| PRI / NI | Kernel priority and nice value (-20 is the highest priority, 19 the lowest) |
| VIRT | Virtual memory: everything the process has mapped, including memory it never uses. Large VIRT is usually harmless |
| RES | Resident memory: physical RAM in use right now. This is the column to watch |
| SHR | Part of RES that is shared with other processes (libraries, shared memory) |
| S | State: R running, S sleeping, D waiting for disk (cannot be killed until the I/O ends), Z zombie, T stopped, I idle kernel thread |
| CPU% | Share of one core. On a multi-core server one process can show more than 100% |
| MEM% | RES as a share of total RAM |
| TIME+ | CPU time used since the process started |
| Command | Full command line; press p to show the program path or name only |
To add columns such as disk read and write rates (IO_READ_RATE, IO_WRITE_RATE) press F2 → Columns. htop --sort-key=help lists every available column with a one-line description.
Keys you will use every day
| Key | Action |
|---|---|
| F6 or > | Choose the sort column |
| P / M / T | Sort by CPU / memory / time |
| I | Invert the sort order |
| F3 or / | Search (jump to the next match) |
| F4 or \ | Filter: show only matching processes, for example php-fpm or lsphp |
| F5 or t | Tree view: see which parent started what (cron → shell → php) |
| u | Show one user’s processes only |
| H / K | Hide or show user threads / kernel threads |
| Space / c | Tag a process / tag it with its children |
| F9 or k | Send a signal to the selected (or tagged) processes; 15 SIGTERM first, 9 SIGKILL only if that fails |
| F7 / F8 | Raise / lower priority (nice) |
| l / s | Open files (needs lsof) / trace system calls (needs strace) |
| F2 | Setup: meters, columns, colours; saved to ~/.config/htop/htoprc |
| F10 or q | Quit |
Command-line options (htop 3.3)
From htop --help on our lab:
htop -u site1 # only one user's processes
htop -p 1234,5678 # only these PIDs
htop -F php-fpm # start with a filter
htop -t # tree view
htop -s PERCENT_MEM # sort by memory (htop --sort-key=help lists the keys)
htop -d 50 # refresh every 5 seconds (tenths of a second; default 15)
htop -n 20 # quit after 20 updates
htop --readonly # no kill, renice or other changes
htop -C # monochrome, for poor terminals--readonly is useful when you give someone less experienced a look at a production server. As root, htop drops the Linux capabilities it does not need by default (--drop-capabilities=basic).
Hosting server examples
Which account is using the CPU?
Sort by CPU (P) and read the USER column. If one account owns most of the top lines, press u and select it, then F5 to see whether the PHP processes come from the web server or from a cron job. To see which script is running, look at the account’s access log at that moment; see where the logs are.
Is it the database?
If mariadbd or mysqld is on top, htop cannot show the query. Run mysqladmin processlist or check the slow query log; see MariaDB slow queries and too many connections.
High load but idle CPUs?
Look for processes in state D. Many D processes plus idle CPU bars mean the disk is the bottleneck: check a backup job, a full disk, or I/O per process with iotop-c or pidstat -d 5. For the full method, see high load on a cPanel server.
What htop cannot tell you
- History. htop shows only the present. For what happened overnight, use atop’s logs or sysstat’s
sar; see find the cause of past high load with atop and sar. - Disk and network per process are limited. Use
iotop-cfor disk andnethogsfor network. - Other servers. htop is one server at a time. For a browser view or several servers, see htop vs btop vs Glances vs atop.
Frequently asked questions
What is the difference between VIRT and RES in htop?
VIRT is all the memory a process has mapped, including memory it has reserved but not used. RES is the physical RAM it uses right now. Watch RES; a large VIRT on its own is not a problem.
What is a good load average in htop?
Compare it with the number of CPU cores (nproc). A load equal to the core count means fully busy; well above it for a long time means work is waiting. On Linux, processes waiting for disk also raise the load.
Why does a process show more than 100% CPU in htop?
CPU% is measured against one core. A multi-threaded process on a server with several cores can use 200% or more.
How do I show only one user’s processes in htop?
Start it with htop -u USERNAME, or press u inside htop and pick the user.
How do I kill a process in htop?
Select it, press F9 (or k), choose 15 SIGTERM and press Enter. Use 9 SIGKILL only if the process ignores SIGTERM. Processes in state D cannot be killed until their disk I/O finishes.
Reading a lot of our guides? Go ad-free with srvScripts Pro for $6 a month. It also pays for new guides. Cancel any time.