Monitor Your VPS in Real Time: Using htop and Netdata to Catch Performance Issues Early

A VPS that runs smoothly for weeks and then suddenly slows down is usually suffering from a problem that was visible in the metrics long before anyone noticed. Memory leaks, CPU steal from noisy neighbors, and disk I/O saturation all leave clear traces. This guide pairs two lightweight tools — htop for instant interactive diagnostics and Netdata for continuous automated monitoring — to give you full visibility into what your VPS is doing right now and what it did while you were asleep.

The Two-Tool Monitoring Stack

htop and Netdata solve different problems. htop is what you open when SSH feels sluggish and you need to know why within 10 seconds. Netdata is what you check when you want to know whether CPU usage spiked at 3 AM. Together they cover both real-time triage and historical trend analysis without the complexity of a full Prometheus/Grafana stack.

• htop: Interactive process viewer with per-core CPU bars, memory, swap, and process tree. Installed in one command, uses negligible resources.
• Netdata: Collects 2,000+ metrics per second, renders dashboards in a browser, and ships with pre-configured alarms. Idles at 1–3% CPU on a single-core VPS.

Installing and Using htop

# Ubuntu/Debian
sudo apt install htop -y

# RHEL/Rocky/Alma
sudo dnf install htop -y

# Launch
htop

The top section shows CPU usage per core, memory, swap, load average, and uptime. The process list is sortable by any column. The most useful shortcuts:

Key	What It Does
F6	Sort by CPU%, MEM%, or TIME+ to find resource hogs
F4	Filter by process name — type “nginx” or “mysql”
F5	Tree view to see parent/child process relationships
F9	Kill a process with SIGTERM (then SIGKILL if needed)
\	Filter by username — isolate what “www-data” is doing
Space	Tag a process for batch operations

Three Patterns to Diagnose Immediately

When you open htop on a struggling VPS, look for these three patterns:

1. High CPU Steal Time

The CPU bar in htop shows st (steal) as a percentage. Steal time is CPU time your VPS wanted but the hypervisor gave to another VM. If steal is consistently above 5% while your load is high, your provider is oversubscribing the physical host. No amount of tuning on your side fixes this — the only solution is a different provider or a dedicated CPU plan. Compare VPS providers that offer guaranteed CPU allocation.

2. Memory Leak Detection

Sort by MEM% (F6). If a process shows steadily increasing memory over days, it has a leak. Common culprits: PHP-FPM pools without pm.max_requests, Python applications without garbage collection tuning, and database servers with misconfigured buffer pools. Identify the process, then check its memory growth pattern:

# Check a process's memory over time
while true; do
    ps -o pid,rss,comm -p <PID> | tail -1
    sleep 60
done

3. Runaway CPU Process

A single process at 100% CPU for more than a few seconds is either a bug or an intrusion. In htop, highlight the process and press l (lowercase L) to see its open files. Press s to trace system calls with strace:

# From the shell, trace what the process is doing
sudo strace -p <PID> -c -f

Installing Netdata for Continuous Monitoring

Netdata installs with a single command and starts collecting immediately:

wget -O /tmp/netdata-kickstart.sh https://get.netdata.cloud/kickstart.sh
sh /tmp/netdata-kickstart.sh --stable-channel --disable-telemetry

Netdata listens on port 19999. Do not expose this port to the internet. Access it through an SSH tunnel:

# From your local machine
ssh -L 19999:127.0.0.1:19999 user@your-vps-ip

# Then open http://localhost:19999 in your browser

For permanent access, put Netdata behind an Nginx reverse proxy with basic authentication or restrict it to a WireGuard VPN interface.

Configuring Alarms That Matter

Netdata ships with hundreds of pre-configured alarms. The most important ones for a VPS:

• cpu.steal — Warns at 10% steal, critical at 20%. This is the most actionable VPS alarm.
• ram.available — Warns when free RAM drops below 20% of total.
• disk.space_usage — Warns at 80% utilization, critical at 90%.
• disk.backlog — Warns when disk I/O queue depth exceeds 100ms, indicating I/O saturation.
• net.net_drops — Warns when the network interface drops packets, often a sign of a saturated link.

Configure notification delivery in /etc/netdata/health_alarm_notify.conf:

# Discord webhook example
SEND_DISCORD="YES"
DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/..."
DEFAULT_RECIPIENT_DISCORD="alerts"

# Telegram example
SEND_TELEGRAM="YES"
TELEGRAM_BOT_TOKEN="123456:ABC-DEF"
DEFAULT_RECIPIENT_TELEGRAM="-100123456"

sudo systemctl restart netdata

Tuning Netdata for Small VPS Instances

On a 1 GB VPS, Netdata’s default settings may use too much memory. Edit /etc/netdata/netdata.conf:

[global]
    update every = 2

[db]
    mode = dbengine
    dbengine page cache size = 16
    storage tiers = 1
    retention = 86400

These settings reduce memory usage to about 100 MB while keeping 24 hours of per-second data. The update every = 2 directive halves the collection frequency, which is fine for trend analysis.

A Daily Health Check Routine

Spend 60 seconds each day on this checklist:

1. htop: Check load average vs. vCPU count. If load > vCPUs, investigate. Look at steal time.
2. Netdata dashboard: Scan the last 24 hours of CPU, RAM, disk, and network charts. A gradual upward slope in any metric is a slow leak.
3. Disk usage: df -h — if any filesystem is above 80%, find and rotate logs or clean old data.
4. Alarm history: In Netdata, click the alarm bell icon to see what fired while you were away. Every alarm that fired is something that needs attention.

This routine catches slow degradation — memory leaks, log growth, neighbor noise — weeks before users notice. For more on choosing a VPS with reliable performance, see our VPS hosting comparison.