htop explained | peteris.rocks

htop explained

Explanation of everything you can see in htop/top on Linux

Last updated on<br>November 17, 2019

#1 on /r/programming on November 16, 2019

#1 on Hacker News on November 1, 2019

#1 on Hacker News on December 2, 2016

#1 on /r/sysadmin on December 2, 2016

For the longest time I did not know what everything meant in htop.

I thought that load average 1.0 on my two core machine means that the CPU usage is at 50%.<br>That's not quite right.<br>And also, why does it say 1.0?

I decided to look everything up and document it here.

They also say that the best way to learn something is to try to teach it.

Table of Contents

htop on Ubuntu Server 16.04 x64

Here is a screenshot of htop that I am going to describe.

Uptime

Uptime shows how long the system has been running.

You can see the same information by running uptime:

$ uptime<br>12:17:58 up 111 days, 31 min, 1 user, load average: 0.00, 0.01, 0.05

How does the uptime program know that?

It reads the information from the file /proc/uptime.

9592411.58 9566042.33

The first number is the total number of seconds the system has been up.<br>The second number is how much of that time the machine has spent idle, in seconds<br>The second value may be greater than the overall system uptime on systems with multiple cores<br>since it is a sum.

How did I know that? I looked at what files the uptime program opens when it is run.<br>We can use the strace tool to do that.

strace uptime

There will be a lot of output.<br>We can grep for the open system call.<br>But that will not really work since strace outputs everything to the standard error (stderr) stream.<br>We can redirect the stderr to the standard output (stdout) stream with 2>&1.

Our output is this:

$ strace uptime 2>&1 | grep open<br>...<br>open("/proc/uptime", O_RDONLY) = 3<br>open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 4<br>open("/proc/loadavg", O_RDONLY) = 4

which contains the file /proc/uptime which I mentioned.

It turns out that you can also use strace -e open uptime and not bother with grepping.

So why do we need the uptime program if we can just read the contents of the file?<br>The uptime output is nicely formatted for humans<br>whereas the number of seconds is more useful for using in your own programs or scripts.

Load average

In addition to uptime, there were also three numbers that represent the load average.

$ uptime<br>12:59:09 up 32 min, 1 user, load average: 0.00, 0.01, 0.03

They are taken from the /proc/loadavg file.<br>If you take another look at the strace output, you'll see that this file was also opened.

$ cat /proc/loadavg<br>0.00 0.01 0.03 1/120 1500

The first three columns represent the average system load of the last 1, 5, and 15 minute periods. The fourth column shows the number of currently running processes and the total number of processes. The last column displays the last process ID used.

Let's start with the last number.

Whenever you launch a new process, it is assigned an ID number. Process IDs are usually increasing, unless they've been exausted and are being reused.<br>The process ID of 1 belongs to /sbin/init which is started at boot time.

Let's look at the /proc/loadavg contents again and then launch the sleep command in the background.<br>When it's launched in the background, its process ID will be shown.

$ cat /proc/loadavg<br>0.00 0.01 0.03 1/123 1566<br>$ sleep 10 &<br>[1] 1567

So the 1/123 means that there is one process running or ready to run at this time and there are 123 processed in total.

When you run htop and see just one running process, it means that it is the htop process itself.

If you run sleep 30 and run htop again, you'll notice that there is still just 1 running process.<br>That's because sleep is not running, it is sleeping or idling or in other words waiting for something to happen.<br>A running process is a process that is currently running on the physical CPU or waiting its turn to run on the CPU.

If you run cat /dev/urandom > /dev/null which repeatedly generates random bytes and writes them to a special file that is never read from,<br>you will see that there are now two running process.

$ cat /dev/urandom > /dev/null &<br>[1] 1639<br>$ cat /proc/loadavg<br>1.00 0.69 0.35 2/124 1679

So there are now two running processes (random number generation and the cat that reads the contents of /proc/loadavg)<br>and you'll also notice that the load averages have increased.

The load average represents the average system load over a period of time.

The load number is calculated by counting the number of running (currently running or waiting to run)<br>and uninterruptible processes (waiting for disk or network activity).<br>So it's simply a number of processes.

The load averages are then the average number of those processes during the last 1, 5 and 15 minutes, right?

It turns out it's not as simple as that.

The load average is the exponentially damped moving average of the load number. From Wikipedia:

Mathematically speaking, all three values always average all the system load since...