# htop Explained for Server Admins: Every Column, Key and Option (htop 3.3)

Source: https://srvscripts.com/guides/htop-explained-linux-server/
Updated: 2026-10-11
Publisher: srvScripts (https://srvscripts.com/)

**Short answer:** install htop with `dnf install htop` (from EPEL) or `apt install htop`. The bars at the top show each CPU core and memory, and the load average should be compared with the number of cores. Look at the **RES** column for real memory use; **VIRT** is mostly reserved address space. Press F6 to change the sort, P or M to sort by CPU or memory, F4 to filter, F5 for the process tree, u to pick one user and F9 to send a signal. htop shows only the present moment. To see what happened at 3 a.m., use atop or sar logs.

We checked everything on this page with htop 3.3.0 from EPEL on our cPanel lab (AlmaLinux 9.8, 4 cores, 3.8 GB RAM) on 11 October 2026. Debian 12 ships htop 3.2.2; the newest upstream release is 3.5 (May 2026), which adds a backtrace screen and new meters. Colours and a few keys can differ between versions, so press F1 in your htop for its own legend.

## Install htop

```
# AlmaLinux / Rocky / CloudLinux (htop is in EPEL)
dnf install epel-release && dnf install htop
# Debian / Ubuntu
apt install htop
htop --version
```

htop was already installed on our cPanel lab. It uses about 5 MB of memory and around 2% of one core at the default refresh of 1.5 seconds.

## The header: CPU, memory, tasks and load

| Meter | What it means | When to worry |
| --- | --- | --- |
| CPU bars (one per core) | How busy each core is. Colours split the time: by default green is normal user processes, red is kernel time and blue is low-priority (niced) work. With “detailed CPU time” on (F2 → Display options) you also see I/O wait and steal | All cores near 100% for minutes, a lot of red (kernel), or steal time on a VPS (the host is overloaded) |
| Mem | Used memory. Buffers and cache are shown in other colours and are given back when programs need them | Used (not cache) near the total while swap grows |
| Swp | Swap in use | Swap use that keeps growing, together with a high load: the server is short of RAM |
| Tasks | Processes, threads and how many are running right now | Thousands of tasks from one user (a fork bomb or runaway cron) |
| Load average | The average number of processes running or waiting, over 1, 5 and 15 minutes | Above the number of cores for a long time |
| Uptime | Time since the last boot | A recent reboot nobody planned |

**Load average against cores:** our lab has 4 cores (`nproc`), so a load of 4.0 means fully busy and 8.0 means half the work is waiting. On Linux, processes waiting for disk (state D) also count towards the load, so a high load with idle CPU bars usually means slow storage, not a CPU problem.

## The columns

| Column | Meaning |
| --- | --- |
| PID | Process ID; use it with kill, lsof -p or strace -p |
| USER | Owner. On cPanel and DirectAdmin, PHP processes run as the site’s account, so this tells you which customer is busy |
| PRI / NI | Kernel priority and nice value (-20 is the highest priority, 19 the lowest) |
| VIRT | Virtual memory: everything the process has mapped, including memory it never uses. Large VIRT is usually harmless |
| RES | Resident memory: physical RAM in use right now. This is the column to watch |
| SHR | Part of RES that is shared with other processes (libraries, shared memory) |
| S | State: R running, S sleeping, D waiting for disk (cannot be killed until the I/O ends), Z zombie, T stopped, I idle kernel thread |
| CPU% | Share of one core. On a multi-core server one process can show more than 100% |
| MEM% | RES as a share of total RAM |
| TIME+ | CPU time used since the process started |
| Command | Full command line; press p to show the program path or name only |

To add columns such as disk read and write rates (`IO_READ_RATE`, `IO_WRITE_RATE`) press F2 → Columns. `htop --sort-key=help` lists every available column with a one-line description.

## Keys you will use every day

| Key | Action |
| --- | --- |
| F6 or > | Choose the sort column |
| P / M / T | Sort by CPU / memory / time |
| I | Invert the sort order |
| F3 or / | Search (jump to the next match) |
| F4 or \ | Filter: show only matching processes, for example php-fpm or lsphp |
| F5 or t | Tree view: see which parent started what (cron → shell → php) |
| u | Show one user’s processes only |
| H / K | Hide or show user threads / kernel threads |
| Space / c | Tag a process / tag it with its children |
| F9 or k | Send a signal to the selected (or tagged) processes; 15 SIGTERM first, 9 SIGKILL only if that fails |
| F7 / F8 | Raise / lower priority (nice) |
| l / s | Open files (needs lsof) / trace system calls (needs strace) |
| F2 | Setup: meters, columns, colours; saved to ~/.config/htop/htoprc |
| F10 or q | Quit |

## Command-line options (htop 3.3)

From `htop --help` on our lab:

```
htop -u site1                # only one user's processes
htop -p 1234,5678            # only these PIDs
htop -F php-fpm              # start with a filter
htop -t                      # tree view
htop -s PERCENT_MEM          # sort by memory (htop --sort-key=help lists the keys)
htop -d 50                   # refresh every 5 seconds (tenths of a second; default 15)
htop -n 20                   # quit after 20 updates
htop --readonly              # no kill, renice or other changes
htop -C                      # monochrome, for poor terminals
```

`--readonly` is useful when you give someone less experienced a look at a production server. As root, htop drops the Linux capabilities it does not need by default (`--drop-capabilities=basic`).

## Hosting server examples

### Which account is using the CPU?

Sort by CPU (P) and read the USER column. If one account owns most of the top lines, press u and select it, then F5 to see whether the PHP processes come from the web server or from a cron job. To see which script is running, look at the account’s access log at that moment; see [where the logs are](/guides/linux-server-log-file-locations/).

### Is it the database?

If `mariadbd` or `mysqld` is on top, htop cannot show the query. Run `mysqladmin processlist` or check the slow query log; see [MariaDB slow queries](/guides/mariadb-slow-queries-11-12/) and [too many connections](/guides/fix-mysql-too-many-connections-cpanel/).

### High load but idle CPUs?

Look for processes in state D. Many D processes plus idle CPU bars mean the disk is the bottleneck: check a backup job, a full disk, or I/O per process with `iotop-c` or `pidstat -d 5`. For the full method, see [high load on a cPanel server](/guides/high-load-cpanel-server/).

## What htop cannot tell you

- **History.** htop shows only the present. For what happened overnight, use atop’s logs or sysstat’s `sar`; see [find the cause of past high load with atop and sar](/guides/atop-sar-history-high-load/).

- **Disk and network per process** are limited. Use `iotop-c` for disk and `nethogs` for network.

- **Other servers.** htop is one server at a time. For a browser view or several servers, see [htop vs btop vs Glances vs atop](/guides/htop-vs-btop-vs-glances-vs-atop/).

## Frequently asked questions

### What is the difference between VIRT and RES in htop?

VIRT is all the memory a process has mapped, including memory it has reserved but not used. RES is the physical RAM it uses right now. Watch RES; a large VIRT on its own is not a problem.

### What is a good load average in htop?

Compare it with the number of CPU cores (nproc). A load equal to the core count means fully busy; well above it for a long time means work is waiting. On Linux, processes waiting for disk also raise the load.

### Why does a process show more than 100% CPU in htop?

CPU% is measured against one core. A multi-threaded process on a server with several cores can use 200% or more.

### How do I show only one user’s processes in htop?

Start it with htop -u USERNAME, or press u inside htop and pick the user.

### How do I kill a process in htop?

Select it, press F9 (or k), choose 15 SIGTERM and press Enter. Use 9 SIGKILL only if the process ignores SIGTERM. Processes in state D cannot be killed until their disk I/O finishes.