Watching Processes and Resources: top / htop / ps to Track Down High Load

When your server suddenly slows down and pages stop loading, the first move isn't to reboot — it's to log in and find out what's actually hogging the machine. This guide walks you through a few basic commands to pinpoint the culprit fast.

Reading live load with top

top ships with every Linux system. Just run it:

top

A few header fields are worth understanding:

• load average: the average load over the last 1, 5, and 15 minutes. Compare it against your CPU core count — on a 4-core box, a load steadily above 4 means work is queuing up and the system is under strain.
• %Cpu(s): us is time spent in user programs, sy in the kernel, and id is idle. When id is near 0, your CPU is maxed out.
• KiB Mem / KiB Swap: memory and swap usage. Heavy swap use usually means you're short on physical RAM.

The most useful trick is sorting the process list. Press P to sort by CPU, M to sort by memory, and q to quit. Whatever sits at the top is often your offender.

htop: a friendlier alternative

htop offers a nicer interface with color bars and mouse support, though you usually need to install it first:

sudo apt update
sudo apt install htop
htop

It shows per-core usage as colored bars up top. Use the arrow keys to highlight a process, then F9 to kill it, F6 to change the sort order, and F10 to exit. If you're new to this, reach for htop first.

Finding processes precisely with ps

Where top is for live watching, ps is for grabbing a one-off snapshot or filtering:

ps aux --sort=-%cpu | head    # top CPU consumers, highest first
ps aux | grep nginx           # find a specific process by name

The second column, PID, is the process ID — you'll need it to stop the process.

Stopping a runaway process

Once you have the PID, try a graceful shutdown first so the program can clean up and exit on its own:

kill 1234

If the process is frozen and plain kill does nothing, escalate to the forceful signal:

kill -9 1234

kill -9 terminates the process immediately and may lose unsaved data, so treat it as a last resort rather than your first reflex.

Checking memory on its own

To quickly confirm whether you have enough RAM, use free:

free -h

The -h flag prints human-readable GB/MB values. Focus on the available column — that's the memory you can actually still use. A high used figure is fine as long as available is healthy, because Linux happily borrows idle RAM for caching.

How to pinpoint the problem

• CPU maxed out: in top, id sits near 0 — press P and grab the process with the highest %CPU.
• Memory exhausted: free -h shows low available and rising Swap — then press M in top to find the process with the highest %MEM.

Summary

A reliable routine for chasing high load: open top or htop for the big picture and load average → find the top consumer and note its PID → confirm memory with free -h → stop it gracefully with kill, falling back to kill -9 only if needed. Diagnosing before you act beats a blind reboot every time.