htop Cheatsheet

Process monitoring.

Overview

htop is the interactive process monitor that supersedes top: same data, vastly better ergonomics. Five primitives carry most operational use under pressure (interactive tree, sortable columns, filter and search, per-CPU breakdown, accurate memory bar). Fluency turns "the box is slow" into a specific process within seconds rather than the long, awkward dance of ps -ef | grep.

• Interactive process tree. F5 toggles tree view. Catches parent-child relationships, fork bombs, and orphan processes.
• Sortable columns plus filter and search. F6 sorts by CPU, RES, TIME; F4 filters by name; F3 searches. Locates the noisy neighbour fast.
• Per-CPU breakdown. Header shows per-core utilisation. Catches single-core saturation that aggregate CPU% hides.
• Accurate memory bar. Used vs cached vs buffers vs swap, broken out cleanly. Avoids the "Linux is using all my memory!" false alarm.

The approach

Sort by the symptom, drill into the process, kill with care. Five keystrokes cover most incident-response use of htop and they are worth committing to muscle memory before the box is on fire.

• F6 sort by CPU%. First move for compute-side symptoms. The CPU hog is at the top.
• F6 sort by RES. Resident memory column. Catches memory leaks and runaway allocations.
• F4 filter plus F5 tree view. Filter narrows to the suspect process; tree view shows its parent and children. Catches fork bombs in one screen.
• F9 kill with deliberate signal. Sends the chosen signal to the highlighted process. Default is SIGTERM; escalate to SIGKILL only after a graceful attempt.

Why this compounds

Each htop session teaches a little more of the Linux process model. Fluency reduces MTTR on every compute-side incident, and the muscle memory transfers to every box the team logs into. By year two htop is the first window opened during any "is the box ok" investigation.

• Faster investigation. Fluent htop turns vague slowdowns into specific PIDs in seconds. MTTR drops.
• Better process understanding. Each session reinforces the Linux process model. Institutional knowledge grows.
• Universal availability. Installs from any distro's package manager. No dependencies, no special setup.
• Year-one investment, year-two habit. First year builds fluency; by year two, htop is the default first window on any troubled box.