htop Command: Interactive Process Monitoring and Tree Visualisation

What is htop?

htop is an enhanced interactive process viewer for Linux, providing a colour-coded, ncurses-based interface that improves significantly on the standard top command. Its most security-relevant feature is the process tree view, which renders parent-child process relationships as a visual hierarchy. This is critical for detecting web shells: a legitimate Apache or nginx process should only spawn expected child processes. When a web server process spawns a bash or python shell, that anomalous parent-child relationship is immediately visible in htop’s tree view — whereas flat process lists require manual PPID cross-referencing. htop also allows scrolling horizontally to see full command arguments, colour-coded CPU bars per core, and mouse interaction for selecting and killing processes. It is not installed by default on all distributions but is available in standard package repositories on every major Linux distro.

Syntax

htop
htop -u www-data
htop -p 1234,5678
htop -d 10
htop --tree

Run htop with no arguments for the full interactive dashboard. Use -u to filter by user. The -d flag sets the refresh delay in tenths of a second (e.g. -d 10 = 1 second). The --tree flag starts htop with process tree view enabled immediately, without needing to press F5.

Key Options and Interactive Commands

Common Use Cases

Detect a Web Shell Spawning a Bash Process

A web shell executed through a vulnerable PHP or upload endpoint will cause a web server worker process to spawn an interactive shell. In htop’s tree view, this appears as apache2 or php-fpm with a child bash or sh process — a relationship that should never occur legitimately. This is one of the fastest ways to confirm an active web shell exploitation without log analysis.

htop --tree
# Look for: apache2 -> bash, nginx -> python, php-fpm -> sh

Audit All Processes Under a Service Account

Service accounts such as www-data, postgres, and redis should only run their expected processes. Filtering htop to a single user and enabling tree view gives a complete picture of everything that service account is running — including any processes spawned through exploitation.

htop -u www-data --tree

Trace a Suspicious PID Back to Its Origin

When an alert or log entry references a suspicious PID, htop’s tree view lets you immediately see what spawned it. Navigating up the tree from the suspicious process to its parent and grandparent reveals the initial access vector — whether a cron job, a web request, or an interactive SSH session.

htop --tree
# Use F4 to filter by the suspicious process name, then expand tree

Security Relevance: Web Shell Detection via Process Tree Inspection

Practical Examples

Start htop with tree view to inspect process parent-child relationships

htop --tree

Immediately shows the full process hierarchy. Scan for web server processes with unexpected shell children — this is the primary web shell detection pattern.

Filter to a specific user and show their full process tree

htop -u www-data --tree

Restricts the view to the web server user and renders all its processes as a tree. Any shell or network tool under www-data is a high-confidence indicator of compromise.

Install htop if not present (Debian/Ubuntu and RHEL/AlmaLinux)

# Debian/Ubuntu
apt install htop -y

# RHEL / AlmaLinux / Rocky
dnf install htop -y

htop is available in standard repositories on all major distributions. Install it immediately on any new server so it is available when needed during an incident.

Troubleshooting Common Issues

Summary

htop’s process tree view is the most direct way to detect web shell exploitation on a running Linux server. By making parent-child process relationships visually explicit, it surfaces the anomalous pattern of a web server spawning a shell interpreter — a relationship that is nearly impossible in legitimate operation. Install htop on every server during provisioning so it is available when needed, not after an incident has already begun.

• Start with htop --tree during any web application incident to check for shell processes spawned by web server workers
• Use htop -u www-data --tree to audit the complete process footprint of your web server user
• A process that re-spawns immediately after being killed has a watchdog parent — find and kill the parent process first