top & htop: Process Monitoring

Load average interpretation, CPU time breakdown columns, interactive commands, and htop advantages.

Overview

Overview top and htop are the first tools you reach for when investigating system performance. Understanding what you're looking at is critical — the numbers can be misleading without context.

Load average: The three numbers (e.g., 2.50 0.80 0.40) represent the average number of runnable or uninterruptible-sleep processes over the last 1, 5, and 15 minutes. A process in either state contributes 1.0 to the load. Rule of thumb: divide by CPU count. On a 4-core system, load 4.0 means fully loaded, 8.0 means severely overloaded (processes waiting for CPU). A rising trend (15-min higher than 1-min) means load is increasing.

CPU time columns (in top header): %us = user space (application code), %sy = system/kernel (time spent in kernel on behalf of processes), %ni = niced processes, %id = idle (available headroom), %wa = I/O wait (CPU idle while waiting for disk or network I/O — high value is a disk bottleneck indicator), %hi = hardware interrupts, %si = software interrupts, %st = steal time (CPU stolen by hypervisor for other VMs — on cloud instances, high %st means noisy neighbor).

Process table columns: PID, USER, PR (priority, lower=higher priority), NI (nice value -20 to 19), VIRT (virtual memory allocated), RES (resident set — actual RAM in use), SHR (shared memory), S (state: R=running, S=sleeping, D=uninterruptible, Z=zombie, T=stopped), %CPU, %MEM, TIME+, COMMAND.

Interactive top commands: k = kill by PID, r = renice, P = sort by CPU, M = sort by memory, T = sort by CPU time, u = filter by user, 1 = toggle per-CPU breakdown (shows all cores individually), H = show threads, q = quit.

htop advantages over top: Color-coded display, mouse support, visual CPU/memory bars, tree view (F5) for parent/child relationships, easier kill (F9 + signal selection), filter by string (F4), and sorting by column click. htop also shows CPU numbers rather than aggregate.

Zombie processes: Shown as Z in state column. Child process has exited but parent hasn't called wait() to collect its exit status. The zombie holds a PID but no resources. Fix: fix the parent process code or restart the parent.

Key concepts

Load average vs CPU count
Load = runnable + uninterruptible processes. Divide by CPU count for % saturation. Load 8 on 8-core = 100% loaded. Trend matters: 15min > 5min > 1min = increasing load.
%wa for I/O wait
%wa shows CPU idle while waiting for I/O. High %wa indicates disk or network bottleneck — the CPU has work to do but is blocked on I/O. Check with iostat -x for disk details.
%st steal time
On VMs/cloud: time the hypervisor gave this VM's CPU to another VM. High %st (>5%) indicates noisy neighbor or VM undersizing. Not tunable by the guest — escalate to cloud provider.
Zombie processes
State Z: process exited but parent hasn't called wait(). Holds PID only — no CPU or memory. Not a problem unless thousands accumulate (PID exhaustion). Fix: restart the parent.

When to use it

  • First-pass investigation of a slow or unresponsive system
  • Identifying which process is consuming unexpected CPU or memory
  • Monitoring CPU distribution across cores (top 1 key)
  • Finding zombie processes and high load average root causes

Interview questions

  • A server shows load average of 8.0 on a 4-CPU system. Walk through how you'd diagnose what's causing it.
  • What does high %wa (I/O wait) in top indicate, and how is it different from high %us?

Sign up free to read the full topic

More Linux topics

Start free on Cariara · Coding problems · System design studio