LFCS 133 🐧 Monitoring — top and htop - KandZ

⏱️ Estimated read: 9 min | |

The previous chapters covered logs and their rotation. This chapter covers real-time process monitoring: the top command, which is available on every Unix-like system, and htop, which is the enhanced interactive alternative. Both tools show a snapshot of the running processes, updated at a configurable interval. The LFCS exam tests the interpretation of the top output: the load average, the CPU usage breakdown, the memory usage, and the per-process fields. The critical distinction is between the system-wide summary (the top five lines) and the process list (the bottom section). The load average is the most misunderstood metric: it is the number of processes that are runnable or uninterruptible, averaged over 1, 5, and 15 minutes. It is not a percentage, and it is not normalized to the number of CPU cores.

Key point: The top command displays a live view of the process table. The -d flag sets the refresh interval. The -p flag selects specific PIDs. The -b flag runs in batch mode, which is useful for scripts. The interactive keys include k (kill), r (renice), M (sort by memory), P (sort by CPU), and q (quit). The htop command provides color, mouse support, a tree view, and function-key shortcuts. It is installed separately (apt install htop or yum install htop).

Why process monitoring requires a specific mental model

The load average problem. The load average is the number of processes in the runnable state (running or waiting for CPU) and in the uninterruptible state (waiting for I/O). A load average of 4.00 on a four-core system means every core is fully utilized. The same load average on a single-core system means the system is four times overloaded. The value is not a percentage. It does not tell you which processes are responsible. The top output shows the load average in the first line, next to the uptime.

The CPU percentage problem. The top summary shows the CPU usage as a breakdown: us (user), sy (system), ni (niced), id (idle), wa (I/O wait), hi (hardware interrupts), si (software interrupts), and st (steal). The us and sy are the processes. The wa is the time spent waiting for I/O, which is not CPU usage but is often misread as such. A high wa means the disk is slow, not the CPU.

The process state problem. The S column in the process list is the state: R (running), S (sleeping), D (uninterruptible sleep, typically I/O), Z (zombie), T (stopped), and I (idle kernel thread). A D state process contributes to the load average even though it is not using CPU. A Z state process is a child that has exited but the parent has not called wait(). The state is the first diagnostic signal.

The memory problem. The top summary shows total, free, used, buff/cache, and available. The buff/cache is memory used for filesystem cache and buffers, which is reclaimable. The available is the memory that can be allocated to new processes without swapping. The used is the memory actually in use by processes, excluding cache. A system with low free memory is not necessarily short on memory; the available is the metric that matters.

The trade-off. top is universal and does not require installation. htop is more usable but requires the package. The top batch mode is scriptable. The htop is interactive only. The exam tests top because it is the baseline, but the practical monitoring tool on most systems is htop.

a. The `top` summary and process list

The top command displays a summary at the top and a process list below.

top

The summary lines are:

top - 10:30:00 up 5 days,  2:15,  3 users,  load average: 0.50, 0.75, 1.00
Tasks: 250 total,   2 running, 248 sleeping,   0 stopped,   0 zombie
%Cpu(s):  5.0 us,  2.0 sy,  0.0 ni, 92.5 id,  0.5 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :  15800.0 total,   2000.0 free,   5000.0 used,   8800.0 buff/cache
MiB Swap:   2048.0 total,   2048.0 free,      0.0 used.   9000.0 avail Mem

The first line shows the current time, the uptime, the number of logged-in users, and the load average for 1, 5, and 15 minutes. The second line shows the task counts by state. The third line shows the CPU breakdown. The fourth and fifth lines show the memory and swap usage.

The process list has these columns:

Column	Meaning
`PID`	Process ID
`USER`	Owner
`PR`	Priority
`NI`	Nice value
`VIRT`	Virtual memory
`RES`	Resident memory
`SHR`	Shared memory
`S`	State
`%CPU`	CPU usage
`%MEM`	Memory usage
`TIME+`	Total CPU time
`COMMAND`	Process name

The VIRT is the total virtual memory the process has mapped, including files, shared libraries, and swapped-out pages. The RES is the physical memory the process is currently using. The SHR is the shared memory. The %MEM is the RES divided by the total physical memory.

b. Interactive keys and sorting

The top command accepts single-key commands while running.

Key	Action
`k`	Kill a process (prompts for PID and signal)
`r`	Renice a process (prompts for PID and nice value)
`M`	Sort by memory usage
`P`	Sort by CPU usage
`T`	Sort by time
`1`	Toggle per-CPU display
`c`	Toggle command line vs program name
`h`	Show help
`q`	Quit

The k key prompts for the PID and the signal. The default signal is 15 (SIGTERM). The 9 (SIGKILL) is the last resort. The r key prompts for the PID and the nice value. A positive nice value lowers the priority; a negative value raises it and requires root.

The sorting is the mechanism for identifying the process that is consuming the CPU or memory. The P key sorts by CPU, which puts the top CPU consumer at the top. The M key sorts by memory.

c. Batch mode and `htop`

The -b flag runs top in batch mode, which is the format for scripts and for watch pipelines.

# Batch mode, one iteration
top -b -n 1

# Batch mode, 5 iterations at 2-second intervals
top -b -n 5 -d 2

# Monitor specific PIDs
top -p 1234,5678

The -n flag is the number of iterations. The -d is the delay between iterations in seconds. The -p flag selects specific PIDs.

The htop command is the enhanced alternative. It provides color, a tree view, a scrollable process list, a search function, and function-key shortcuts for the common actions.

htop

The function keys are displayed at the bottom of the screen. The F3 is search. The F4 is filter. The F5 is tree view. The F6 is sort. The F9 is kill. The F10 is quit.

The htop configuration is stored in ~/.config/htop/htoprc. The htop --sort-key flag selects the sort column at startup. The htop -u <user> flag shows only the processes of a specific user.

Complete Example Session

# ============================================
# PART 1: BASIC TOP
# ============================================

top
# Shows the summary and process list.
# Press q to quit.

# ============================================
# PART 2: INTERPRET THE SUMMARY
# ============================================

# Line 1: load average: 0.50, 0.75, 1.00
# 1-minute: 0.50
# 5-minute: 0.75
# 15-minute: 1.00
# The load is decreasing.

# ============================================
# PART 3: INTERPRET CPU
# ============================================

# %Cpu(s): 5.0 us, 2.0 sy, 0.0 ni, 92.5 id, 0.5 wa
# 5% user, 2% system, 92.5% idle, 0.5% I/O wait

# ============================================
# PART 4: INTERPRET MEMORY
# ============================================

# MiB Mem: 15800 total, 2000 free, 5000 used, 8800 buff/cache
# Available: 9000 MiB
# The system has 9 GB available for new processes.

# ============================================
# PART 5: SORT BY CPU
# ============================================

top
# Press P to sort by CPU usage.

# ============================================
# PART 6: SORT BY MEMORY
# ============================================

top
# Press M to sort by memory usage.

# ============================================
# PART 7: KILL A PROCESS
# ============================================

top
# Press k, enter PID 1234, press Enter.
# The process is sent SIGTERM.

# ============================================
# PART 8: BATCH MODE
# ============================================

top -b -n 1 | head -n 20
# Batch mode output for scripting.

# ============================================
# PART 9: HTOP
# ============================================

htop
# Color display with function keys.
# F5 for tree view.
# F3 for search.
# F9 to kill.

The nine parts trace the top usage: basic view, summary interpretation, CPU breakdown, memory breakdown, sorting by CPU, sorting by memory, killing a process, batch mode, and htop.

Quick Reference

`top` Options

Option	Purpose
`-d <sec>`	Refresh interval
`-n <count>`	Iterations
`-p <pids>`	Specific PIDs
`-u <user>`	User filter
`-b`	Batch mode

`top` Interactive Keys

Key	Action
`k`	Kill
`r`	Renice
`M`	Sort by memory
`P`	Sort by CPU
`T`	Sort by time
`1`	Per-CPU
`c`	Command line
`q`	Quit

Process States

State	Meaning
`R`	Running
`S`	Sleeping
`D`	Uninterruptible (I/O)
`Z`	Zombie
`T`	Stopped
`I`	Idle kernel thread

Memory Fields

Field	Meaning
`total`	Total physical memory
`free`	Unused memory
`used`	Memory used by processes
`buff/cache`	Filesystem cache
`available`	Allocatable memory

CPU Fields

Field	Meaning
`us`	User
`sy`	System
`ni`	Niced
`id`	Idle
`wa`	I/O wait
`hi`	Hardware interrupts
`si`	Software interrupts
`st`	Steal (hypervisor)

Best Practices

✅ Do This:

top -b -n 1
<!-- Batch mode for scripts -->                      # ✅

top -p 1234
<!-- Monitor a specific process -->                  # ✅

htop
<!-- Use htop for interactive use -->                # ✅

❌ Don’t Do This:

# Interpret load average as a percentage
<!-- It is the number of runnable/uninterruptible procs --> # ❌

# Kill a process with 9 without trying 15
<!-- SIGTERM first, SIGKILL last -->                 # ❌

# Ignore the D state
<!-- A D state process contributes to load -->       # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Load average seems high but CPU idle	I/O wait or D state processes	Check `wa` and `D` state
Memory seems full but system responsive	`buff/cache` is reclaimable	Check `available`
Top output frozen	Process is in D state	Check I/O and disk
Zombies accumulate	Parent not calling `wait()`	Fix parent process
`htop` not found	Package not installed	`apt install htop`

Real-World Examples

1. Basic Top

top

2. Batch Mode

top -b -n 1

3. Monitor PID

top -p 1234

4. Monitor User

top -u alice

5. Refresh Interval

top -d 5

6. Sort by CPU

Press P in top

7. Sort by Memory

Press M in top

8. Kill Process

Press k in top

9. Htop

htop

10. Htop Tree View

Press F5 in htop

Visual

`top` Layout

┌──────────────────────────────────────────────┐
│  Top summary                                 │
│  ├── Load average: 1m, 5m, 15m               │
│  ├── Tasks: running, sleeping, zombie        │
│  ├── CPU: us, sy, id, wa                     │
│  └── Memory: total, free, used, buff/cache   │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Process list                                │
│  PID  USER  %CPU  %MEM  TIME+  COMMAND       │
└──────────────────────────────────────────────┘

Load Average vs CPU

┌──────────────────────────────────────────────┐
│  Load average = 4.0                          │
│  CPU cores = 4                               │
│  → Fully utilized (1.0 per core)             │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Load average = 4.0                          │
│  CPU cores = 1                               │
│  → 4x overloaded                             │
└──────────────────────────────────────────────┘

Summary

Item	Value
Basic monitoring	`top`
Enhanced monitoring	`htop`
Batch mode	`top -b -n 1`
Specific PID	`top -p <pid>`
Sort by CPU	`P`
Sort by memory	`M`
Kill process	`k`
Load average	1m, 5m, 15m runnable/uninterruptible
Memory metric	`available`, not `free`

Key takeaways:

The load average is the number of runnable and uninterruptible processes. It is not a percentage. It must be compared to the number of CPU cores to interpret. A D state process contributes to the load even though it is not using CPU.
The CPU breakdown has eight fields. The us and sy are the user and system time. The wa is the I/O wait, which is not CPU usage. The id is the idle time.
The available memory is the metric that matters. The free memory is low on a healthy system because Linux uses the free memory for cache. The buff/cache is reclaimable.
The k and r keys are the interactive controls. The k sends a signal (default SIGTERM). The r changes the nice value. The P and M keys sort the list by CPU and memory.
The htop is the usable alternative. It provides color, tree view, and function-key shortcuts. It is installed separately. The top is the baseline; htop is the preferred tool when available.

Remember: top is the universal process monitor. The summary is the system state. The process list is the individual state. The load average is the backlog. The CPU breakdown is the usage. The memory is the pressure. The htop is the same information with a better interface. The exam tests the interpretation of the summary and the interactive keys.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!