Monitor a VPS with htop

htop is an interactive version of top: easier to read, faster to sort, and enough to understand what is happening on a VPS at the moment you look. It does not replace long-term monitoring, but it answers "what is consuming resources?" in seconds.

Install and find your way

sudo apt install htop
htop

Key bindings: F3 searches, F4 filters, F5 shows the process tree, F6 chooses the sort column, F9 sends a signal, F2 opens setup. u filters by user, H toggles threads. Use F5 as soon as a service spawns workers: PHP-FPM, clustered Node.js or Gunicorn become readable.

Read the header correctly

Load average is meaningful relative to the core count: nproc gives that number. A load of 4 on 4 vCPU is saturation, not a disaster; a load of 4 on 1 vCPU is.

In a system container, htop may show the physical cores while your quota is lower. Trust the quota rather than the number of bars:

cat /sys/fs/cgroup/cpu.max

For memory, the bars separate used, buffers and cache. Cache is not lost memory: the kernel reuses it. Watch the swap bar and the RES column of processes above all.

Identify the right process

Sort by %CPU or RES with F6. RES is memory actually occupied; VIRT includes reservations that say nothing about real consumption. With F5 you see which parent process started the consumers: a growing PHP-FPM pool, a leaking Node.js worker or a command launched by hand.

F4 filters by name, which is safer than killing a random PID in a long list.

Act cleanly

F9 sends a signal. Start with SIGTERM (15), which gives the process time to close files and connections. SIGKILL (9) is a last resort: it leaves no chance to clean up.

Never send SIGKILL to PID 1, sshd or systemd-journald without understanding the consequences: you can lose access or logging. To reduce a process's impact without killing it:

sudo renice 10 -p PID
sudo ionice -c3 -p PID

Then fix the cause: a worker limit set too high, an unindexed query, a memory leak. Killing the process every hour is not monitoring.

Know the limits

htop shows only a snapshot, and only your container's processes. For a trend, log top -b -n 1 from cron or use a monitoring tool. And remember that in a system container CPU and memory figures may reflect the platform: compare them with free -h and the cgroup files before concluding.