How to Monitor System Performance with top and htop

Short introduction

Monitoring system performance helps you spot CPU, memory, and I/O bottlenecks before they affect users. This short guide shows practical ways to use top and htop — two core tools available on most Linux systems — and gives clear examples you can try right away.

Why monitor performance (quick checks)

Before diving into top/htop, it helps to know a few quick checks to capture system state. These commands are useful to run once before you start an interactive session so you have a baseline.

Example terminal checks:

# uptime - shows load averages
$ uptime
 10:42:13 up 5 days,  4:33,  2 users,  load average: 0.15, 0.10, 0.07

# free -h - shows memory usage
$ free -h
              total        used        free      shared  buff/cache   available
Mem:           15Gi        6Gi       1.5Gi       128Mi        7Gi        8Gi
Swap:         2.0Gi          0B       2.0Gi

# iostat (from sysstat) - quick I/O stats
$ iostat -x 1 2

Run these once to note load, memory pressure, and I/O trends. They tell you what to look for when you open top or htop.

Using top — basics and practical tips

top is installed by default on most Linux distributions and provides a live, text-based view of processes and system resource usage. It’s lightweight and scriptable.

Start top:

$ top

Basic interactive keys (while top is running):

• P — sort by CPU usage
• M — sort by memory usage
• N — sort by PID
• T — sort by running time
• k — kill a process (enter PID and signal)
• q — quit

Batch mode for scripts or capturing a snapshot:

# non-interactive snapshot sorted by CPU, one iteration
$ top -b -n 1 -o %CPU | head -n 20

Notes and tips:

• top shows per-CPU and overall CPU usage, memory, swap, load averages, and a process list.
• Use top's batch mode (-b -n) to capture output for logs or automated monitoring.
• The column headers can vary by top implementation; check man top for platform-specific options.

Using htop — interactive and user-friendly

htop is an improved, colorful alternative to top with a more intuitive interface. It supports mouse, tree views, easy sorting, and interactive process management.

Start htop:

# if not installed: Debian/Ubuntu
$ sudo apt install htop

# run htop
$ htop

Common interactive shortcuts inside htop:

• F2 — Setup (choose columns, meters)
• F3 — Search for processes by name
• F4 — Filter by substring
• F6 — Sort by a column you choose
• F9 — Kill a process (pick signal)
• F5 — Toggle process tree view
• Space — Tag a process for group operations

Examples:

# view only processes for a user
$ htop -u alice

# view only specific PIDs (comma-separated)
$ htop -p 1234,2345

Why use htop:

• Easier for beginners: keys are labeled at the bottom and the color bars quickly convey usage.
• Interactive filtering and tree view make it simple to find parent/child process relationships.
• You can configure which columns to display (CPU%, MEM%, TIME+, command, etc.) via F2.

Advanced usage: sorting, filtering, and remote snapshots

Both tools support techniques to reduce noise, focus on problem processes, and gather snapshots for analysis.

Sort and limit output:

# show top 10 memory users using ps for scripting
$ ps aux --sort=-%mem | head -n 11

# top snapshot sorted by memory (procps-ng top)
$ top -b -n 1 -o %MEM | head -n 20

Remote monitoring via SSH:

# capture a one-shot top output from a remote host
$ ssh user@remotehost 'top -b -n 1 -o %CPU' > remote-top-$(date +%F-%T).txt

Automated alerts and logs:

• Use periodic top/ps snapshots in a cron job and parse results to detect abrupt CPU or memory spikes.
• Combine with simple scripts to email or push alerts when thresholds are exceeded.

Example: a small script to log top CPU hogs (run from cron):

#!/bin/bash
OUTDIR=/var/log/top-snapshots
mkdir -p "$OUTDIR"
top -b -n 1 -o %CPU | head -n 30 > "$OUTDIR/top-$(date +%F-%T).log"

Be aware of differences between systems: top flags and column names can vary between distributions (procps vs BSD variants). Use man top to confirm available options.

Comparing top and htop — when to use each

Both tools have strengths; choose based on needs and environment.

Quick comparison example (description-style):

top:
- Minimal, always available on many systems
- Easy to use in scripts (-b -n)
- Lower overhead in constrained systems

htop:
- Colorful, interactive, mouse support
- Tree view, easy sorting/filtering
- Better for live troubleshooting and rapid navigation

Guidelines:

• Use top for automated snapshots and remote non-interactive logging.
• Use htop for hands-on troubleshooting when you need to explore process relationships and interactively kill or renice processes.
• If you only have SSH access to a minimal rescue environment, top is more likely to be available.

Common Pitfalls

• Assuming column names and command-line options are identical across Linux distributions — verify with man top / man htop.
• Relying on a single snapshot — spike behavior can be transient; use repeated samples or tools like sar/iostat for trends.
• Killing processes without checking dependencies — abruptly killing a parent process can orphan or destabilize services.

Next Steps

• Install htop on a test machine and practice F-keys (F2/F3/F4/F5/F6/F9) until navigation feels natural.
• Create a simple cron job to capture top snapshots and review logs weekly for trends.
• Explore other tools (vmstat, iostat, sar, atop, nmon) to get a fuller picture of I/O and long-term trends.

If you want, I can provide a ready-to-run cron script and a simple parser that emails you when a process exceeds specified CPU or memory limits.

👉 Explore more IT books and guides at dargslan.com.