1ATOP(1) General Commands Manual ATOP(1)
2
6 atop - AT Computing's System & Process Monitor
7
9 Interactive usage:
10 atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o] [-C|-M|-D|-N|-A] [-af1x] [-L line‐
12 len] [-Plabel[,label]...] [ interval [ samples ]]
13 Writing and reading raw logfiles:
15 atop -w rawfile [-a] [-S] [ interval [ samples ]]
17 atop -r [ rawfile ] [-b hh:mm ] [-e hh:mm ]
18 [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o] [-C|-M|-D|-N|-A] [-f1x] [-L linelen]
19 [-Plabel[,label]...]
20
22 The program atop is an interactive monitor to view the load on a Linux
23 system. It shows the occupation of the most critical hardware
24 resources (from a performance point of view) on system level, i.e. cpu,
25 memory, disk and network.
26 It also shows which processes are responsible for the indicated load
27 with respect to cpu- and memory load on process level. Disk load is
28 shown if per process "storage accounting" is active in the kernel or if
29 the kernel patch `cnt' has been installed. Network load is only shown
30 per process if the kernel patch `cnt' has been installed.
31 Every interval (default: 10 seconds) information is shown about the
33 resource occupation on system level (cpu, memory, disks and network
34 layers), followed by a list of processes which have been active during
35 the last interval (note that all processes that were unchanged during
36 the last interval are not shown, unless the key 'a' has been pressed).
37 If the list of active processes does not entirely fit on the screen,
38 only the top of the list is shown (sorted in order of activity).
39 The intervals are repeated till the number of samples (specified as
40 command argument) is reached, or till the key 'q' is pressed in inter‐
41 active mode.
42 When atop is started, it checks whether the standard output channel is
44 connected to a screen, or to a file/pipe. In the first case it produces
45 screen control codes (via the ncurses library) and behaves interac‐
46 tively; in the second case it produces flat ASCII-output.
47 In interactive mode, the output of atop scales dynamically to the cur‐
49 rent dimensions of the screen/window.
50 If the window is resized horizontally, columns will be added or removed
51 automatically. For this purpose, every column has a particular weight.
52 The columns with the highest weigths that fit within the current width
53 will be shown.
54 If the window is resized vertically, lines of the process-list will be
55 added or removed automatically.
56 Furthermore in interactive mode the output of atop can be controlled by
58 pressing particular keys. However it is also possible to specify such
59 key as flag on the command line. In the latter case atop will switch to
60 the indicated mode on beforehand; this mode can be modified again
61 interactively. Specifying such key as flag is especially useful when
62 running atop with output to a pipe or file (non-interactively). The
63 flags used are the same as the keys which can be pressed in interactive
64 mode (see section INTERACTIVE COMMANDS).
65 Additional flags are available to support storage of atop-data in raw
66 format (see section RAW DATA STORAGE).
67
69 When atop is started, it switches on the process accounting mechanism
70 in the kernel. This forces the kernel to write a record with accounting
71 information to the accounting file whenever a process ends. Apart from
72 the kernel administration related to the running processes, atop also
73 interprets the accounting records on disk with every interval; in this
74 way atop can also show the activity of a process during the interval in
75 which it is finished.
76 Whenever the last incarnation of atop stops (either by pressing `q' or
77 by `kill -15'), it switches off the process accounting mechanism again.
78 You should never terminate atop by `kill -9', because then it has no
79 chance to stop process accounting; as a result the accounting file may
80 consume a lot of disk space after a while.
81 With the environment variable ATOPACCT the name of a specific process
83 accounting file can be specified (accounting should have been activated
84 on beforehand). When this environment variable is present but its con‐
85 tents is empty, process accounting will not be used at all.
86 Notice that root-privileges are required to switch on process account‐
88 ing in the kernel. You can start atop as root or specify setuid-root
89 privileges to the executable file. In the latter case, atop switches
90 on process accounting and immediately drops the root-privileges again.
91
93 For the resource consumption on system level, atop uses colors to indi‐
94 cate that a critical occupation percentage has been (almost) reached.
95 A critical occupation percentage means that is likely that this load
96 causes a noticable negative performance influence for applications
97 using this resource. The critical percentage depends on the type of
98 resource: e.g. the performance influence of a disk with a busy percent‐
99 age of 80% might be more noticable for applications/user than a CPU
100 with a busy percentage of 90%.
101 Currently atop uses the following default values to calculate a
102 weighted percentage per resource:
103 Processor
105 A busy percentage of 90% or higher is considered `critical'.
106 Disk
108 A busy percentage of 70% or higher is considered `critical'.
109 Network
111 A busy percentage of 90% or higher for the load of an interface is
112 considered `critical'.
113 Memory
115 An occupation percentage of 90% is considered `critical'. Notice
116 that this occupation percentage is the accumulated memory consump‐
117 tion of the kernel (including slab) and all processes; the memory
118 for the page cache (`cache' and `buff' in the MEM-line) is not
119 implied!
120 If the number of pages swapped out (`swout' in the PAG-line) is
121 larger than 10 per second, the memory resource is considered
122 `critical'. A value of at least 1 per second is considered
123 `almost critical'.
124 If the committed virtual memory exceeds the limit (`vmcom' and
125 `vmlim' in the SWP-line), the SWP-line is colored due to overcom‐
126 mitting the system.
127 Swap
129 An occupation percentage of 80% is considered `critical' because
130 swap space might be completely exhausted in the near future; it is
131 not critical from a performance point-of-view.
132 These default values can be modified in the configuration file (see
134 separate man-page of atoprc).
135 When a resource exceeded its critical occupation percentage, the entire
137 screen line is colored red.
138 When a resource exceeded (default) 80% of its critical percentage (so
139 it is almost critical), the entire screen line is colored cyan. This
140 `almost critical percentage' (one value for all resources) can be modi‐
141 fied in the configuration file (see separate man-page of atoprc).
142 With the key 'x' (or flag -x), line coloring can be suppressed.
144
146 When running atop interactively (no output redirection), keys can be
147 pressed to control the output. In general, lower case keys can be used
148 to show other information for the active processes and upper case keys
149 can be used to influence the sort order of the active process list.
150 g Show generic output (default).
152 Per process the following fields are shown in case of a window-
154 width of 80 positions: process-id, cpu consumption during the last
155 interval in system- and user mode, the virtual and resident memory
156 growth of the process.
157 The subsequent columns depend on the used kernel: When the kernel
158 patch `cnt' has been installed, the number of read- and write
159 transfers on disk, and the number of received and transmitted net‐
160 work packets are shown for each process. When the kernel patch is
161 not installed and the kernel supports "storage accounting" (>=
162 2.6.20), the data transfer for read/write on disk, the status and
163 exit code are shown for each process. When the kernel patch is
164 not installed and the kernel does not support "storage account‐
165 ing", the username, number of threads in the thread group, the
166 status and exit code are shown.
167 The last columns contain the state, the occupation percentage for
168 the choosen resource (default: cpu) and the process name.
169 When more than 80 positions are available, other information is
171 added.
172 m Show memory related output.
174 Per process the following fields are shown in case of a window-
176 width of 80 positions: process-id, minor and major memory faults,
177 size of virtual shared text, total virtual process size, total
178 resident process size, virtual and resident growth during last
179 interval, memory occupation percentage and process name.
180 When more than 80 positions are available, other information is
182 added.
183 d Show disk-related output.
185 When "storage accounting" is active in the kernel, the following
187 fields are shown: process-id, amount of data read from disk,
188 amount of data written to disk, amount of data that was written
189 but has been withdrawn again (WCANCL), disk occupation percentage
190 and process name.
191 When the kernel patch `cnt' is installed in the kernel, the fol‐
193 lowing fields are shown: process-id, number of physical disk
194 reads, average size per read (bytes), total size for read trans‐
195 fers, physical disk writes, average size per write (bytes), total
196 size for write transfers, disk occupation percentage and process
197 name.
198 n Show network related output.
200 Per process the following fields are shown in case of a window-
202 width of 80 positions: process-id, number of received TCP packets
203 with the average size per packet (in bytes), number of sent TCP
204 packets with the average size per packet (in bytes), number of
205 received UDP packets with the average size per packet (in bytes),
206 number of sent UDP packets with the average size per packet (in
207 bytes), and received and sent raw packets (e.g. ICMP) in one col‐
208 umn, the network occupation percentage and process name.
209 This information can only be shown when kernel patch `cnt' is
210 installed.
211 When more than 80 positions are available, other information is
213 added.
214 s Show scheduling characteristics.
216 Per process the following fields are shown in case of a window-
218 width of 80 positions: process-id, number of threads in state
219 'running' (R), number of threads in state 'interruptible sleeping'
220 (S), number of threads in state 'uninterruptible sleeping' (D),
221 scheduling policy (normal timesharing, realtime round-robin, real‐
222 time fifo), nice value, priority, realtime priority, current pro‐
223 cessor, status, exit code, state, the occupation percentage for
224 the choosen resource and the process name.
225 When more than 80 positions are available, other information is
227 added.
228 v Show various process characteristics.
230 Per process the following fields are shown in case of a window-
232 width of 80 positions: process-id, user name and group, start date
233 and time, status (e.g. exit code if the process has finished),
234 state, the occupation percentage for the choosen resource and the
235 process name.
236 When more than 80 positions are available, other information is
238 added.
239 c Show the command line of the process.
241 Per process the following fields are shown: process-id, the occu‐
243 pation percentage for the choosen resource and the command line
244 including arguments.
245 o Show the user-defined line of the process.
247 In the configuration file the keyword ownprocline can be specified
249 with the description of a user-defined output-line.
250 Refer to the man-page of atoprc for a detailed description.
251 u Show the process activity accumulated per user.
253 Per user the following fields are shown: number of processes
255 active or terminated during last interval (or in total if combined
256 with command `a'), accumulated cpu consumption during last inter‐
257 val in system- and user mode, the current virtual and resident
258 memory space consumed by active processes (or all processes of the
259 user if combined with command `a').
260 When the kernel patch `cnt' has been installed or "storage
261 accounting" is active, the accumulated read- and write throughput
262 on disk is shown. When the kernel patch `cnt' has been installed,
263 the number of received and sent network packets are shown.
264 The last columns contain the accumulated occupation percentage for
265 the choosen resource (default: cpu) and the user name.
266 p Show the process activity accumulated per program (i.e. process
268 name).
269 Per program the following fields are shown: number of processes
271 active or terminated during last interval (or in total if combined
272 with command `a'), accumulated cpu consumption during last inter‐
273 val in system- and user mode, the current virtual and resident
274 memory space consumed by active processes (or all processes of the
275 user if combined with command `a').
276 When the kernel patch `cnt' has been installed or "storage
277 accounting" is active, the accumulated read- and write throughput
278 on disk is shown. When the kernel patch `cnt' has been installed,
279 the number of received and sent network packets are shown.
280 The last columns contain the accumulated occupation percentage for
281 the choosen resource (default: cpu) and the program name.
282 C Sort the current list in the order of cpu consumption (default).
284 The one-but-last column changes to ``CPU''.
285 M Sort the current list in the order of resident memory consumption.
287 The one-but-last column changes to ``MEM''.
288 D Sort the current list in the order of disk accesses issued. The
290 one-but-last column changes to ``DSK''.
291 N Sort the current list in the order of network packets
293 received/transmitted. The one-but-last column changes to ``NET''.
294 A Sort the current list automatically in the order of the most busy
296 system resource during this interval. The one-but-last column
297 shows either ``ACPU'', ``AMEM'', ``ADSK'' or ``ANET'' (the preced‐
298 ing 'A' indicates automatic sorting-order). The most busy
299 resource is determined by comparing the weighted busy-percentages
300 of the system resources, as described earlier in the section COL‐
301 ORS.
302 This option remains valid until another sorting-order is explic‐
303 itly selected again.
304 A sorting-order for disk is only possible when the kernel patch
305 `cnt' is installed or "storage accounting" is active. A sorting-
306 order for network is only possible when the kernel patch `cnt' is
307 installed.
308 Miscellaneous interactive commands:
310 ? Request for help information (also the key 'h' can be pressed).
312 V Request for version information (version number and date).
314 x Suppress colors to highlight critical resources (toggle).
316 Whether this key is active or not can be seen in the header line.
317 z The pause key can be used to freeze the current situation in order
319 to investigate the output on the screen. While atop is paused, the
320 keys described above can be pressed to show other information
321 about the current list of processes. Whenever the pause key is
322 pressed again, atop will continue with a next sample.
323 i Modify the interval timer (default: 10 seconds). If an interval
325 timer of 0 is entered, the interval timer is switched off. In that
326 case a new sample can only be triggered manually by pressing the
327 key 't'.
328 t Trigger a new sample manually. This key can be pressed if the cur‐
330 rent sample should be finished before the timer has exceeded, or
331 if no timer is set at all (interval timer defined as 0). In the
332 latter case atop can be used as a stopwatch to measure the load
333 being caused by a particular application transaction, without
334 knowing on beforehand how many seconds this transaction will last.
335 When viewing the contents of a raw file, this key can be used to
337 show the next sample from the file.
338 T When viewing the contents of a raw file, this key can be used to
340 show the previous sample from the file.
341 b When viewing the contents of a raw file, this key can be used to
343 branch to a certain timestamp within the file (either forward or
344 backward).
345 r Reset all counters to zero to see the system and process activity
347 since boot again.
348 When viewing the contents of a raw file, this key can be used to
350 rewind to the beginning of the file again.
351 U Specify a search string for specific user names as a regular
353 expression. From now on, only (active) processes will be shown
354 from a user which matches the regular expression. The system sta‐
355 tistics are still system wide. If the Enter-key is pressed with‐
356 out specifying a name, active processes of all users will be shown
357 again.
358 Whether this key is active or not can be seen in the header line.
359 P Specify a search string for specific process names as a regular
361 expression. From now on, only processes will be shown with a name
362 which matches the regular expression. The system statistics are
363 still system wide. If the Enter-key is pressed without specifying
364 a name, all active processes will be shown again.
365 Whether this key is active or not can be seen in the header line.
366 a The `all/active' key can be used to toggle between only show‐
368 ing/accumulating the processes that were active during the last
369 interval (default) or showing/accumulating all processes.
370 Whether this key is active or not can be seen in the header line.
371 f Fixate the number of lines for system resources (toggle). By
373 default only the lines are shown about system resources (cpu, pag‐
374 ing, disk, network) that really have been active during the last
375 interval. With this key you can force atop to show lines of inac‐
376 tive resources as well.
377 Whether this key is active or not can be seen in the header line.
378 1 Show relevant counters as an average per second (in the format
380 `..../s') instead of as a total during the interval (toggle).
381 Whether this key is active or not can be seen in the header line.
382 l Limit the number of system level lines for the counters per-cpu,
384 the active disks and the network interfaces. By default lines are
385 shown of all cpu's, disks and network interfaces which have been
386 active during the last interval. Limiting these lines can be use‐
387 ful on systems with huge number cpu's, disks or interfaces in
388 order to be able to run atop on a screen/window with e.g. only 24
389 lines.
390 For all mentioned resources the maximum number of lines can be
391 specified interactively. When using the flag -l the maximum number
392 of per-cpu lines is set to 0, the maximum number of disk lines to
393 5 and the maximum number of interface lines to 3. These values
394 can be modified again in interactive mode.
395 k Send a signal to an active process (a.k.a. kill a process).
397 q Quit the program.
399 ^F Show the next page of the process list (forward).
401 ^B Show the previous page of the process list (backward).
403 ^L Redraw the screen.
405
407 In order to store system- and process level statistics for long-term
408 analysis (e.g. to check the system load and the active processes run‐
409 ning yesterday between 3:00 and 4:00 PM), atop can store the system-
410 and process level statistics in compressed binary format in a raw file
411 with the flag -w followed by the filename. If this file already exists
412 and is recognized as a raw data file, atop will append new samples to
413 the file (starting with a sample which reflects the activity since
414 boot); if the file does not exist, it will be created.
415 By default only processes which have been active during the interval
416 are stored in the raw file. When the flag -a is specified, all pro‐
417 cesses will be stored.
418 The interval (default: 10 seconds) and number of samples (default:
419 infinite) can be passed as last arguments. Instead of the number of
420 samples, the flag -S can be used to indicate that atop should finish
421 anyhow before midnight.
422 A raw file can be read and visualized again with the flag -r followed
424 by the filename. If no filename is specified, the file
425 /var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are
426 digits representing the current date). If a filename is specified in
427 the format YYYYMMDD (representing any valid date), the file
428 /var/log/atop/atop_YYYYMMDD is opened. If a filename with the symbolic
429 name y is specified, yesterday's daily logfile is opened (this can be
430 repeated so 'yyyy' indicates the logfile of four days ago).
431 The samples from the file can be viewed interactively by using the key
432 't' to show the next sample, the key 'T' to show the previous sample,
433 the key 'b' to branch to a particular time or the key 'r' to rewind to
434 the begin of the file.
435 When output is redirected to a file or pipe, atop prints all samples in
436 plain ASCII. The default line length is 80 characters in that case;
437 with the flag -L followed by an alternate line length, more (or less)
438 columns will be shown.
439 With the flag -b (begin time) and/or -e (end time) followed by a time
440 argument of the form HH:MM, a certain time period within the raw file
441 can be selected.
442 When atop is installed, the script atop.daily is stored in the
444 /etc/atop directory. This scripts takes care that atop is activated
445 every day at midnight to write compressed binary data to the file
446 /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes.
447 Furthermore the script removes all raw files which are older than four
448 weeks.
449 The script is activated via the cron daemon using the file
450 /etc/cron.d/atop with the contents
451 0 0 * * * root /etc/atop/atop.daily
452 When the RPM `psacct' is installed, the process accounting is automati‐
454 cally restarted via the logrotate mechanism. The file /etc/logro‐
455 tate.d/psaccs_atop takes care that atop is finished just before the
456 rotation of the process accounting file and the file /etc/logro‐
457 tate.d/psaccu_atop takes care that atop is restarted again after the
458 rotation. When the RPM `psacct' is not installed, these logrotate-
459 files have no effect.
460
462 The first sample shows the system level activity since boot (the
463 elapsed time in the header shows the time since boot). Note that par‐
464 ticular counters could have reached their maximum value (several times)
465 and started by zero again, so do not rely on these figures.
466 For every sample atop first shows the lines related to system level
468 activity. If a particular system resource has not been used during the
469 interval, the entire line related to this resource is suppressed. So
470 the number of system level lines may vary for each sample.
471 After that a list is shown of processes which have been active during
472 the last interval. This list is by default sorted on cpu consumption,
473 but this order can be changed by the keys which are previously
474 described.
475 If values have to be shown by atop which do not fit in the column
477 width, another notation is used. If e.g. a cpu-consumption of 233216
478 milliseconds should be shown in a column width of 4 positions, it is
479 shown as `233s' (in seconds). For large memory figures, another unit
480 is chosen if the value does not fit (Mb instead of Kb, Gb instead of
481 Mb). For other values, a kind of exponent notation is used (value
482 123456789 shown in a column of 5 positions gives 123e6).
483
485 The system level information consists of the following output lines:
486 PRC Process level totals.
488 This line contains the total cpu time consumed in system mode
489 (`sys') and in user mode (`user'), the total number of processes
490 present at this moment (`#proc'), the total number of threads
491 present at this moment in state `running' (`#trun'), `sleeping
492 interruptible' (`#tslpi') and `sleeping uninterruptible'
493 (`#tslpu'), the number of zombie processes (`#zombie'), the number
494 of clone system calls (`clones'), and the number of processes that
495 ended during the interval (`#exit', which shows `?' if process
496 accounting is not used).
497 If the screen-width does not allow all of these counters, only a
498 relevant subset is shown.
499 CPU CPU utilization.
501 At least one line is shown for the total occupation of all CPU's
502 together.
503 In case of a multi-processor system, an additional line is shown
504 for every individual processor (with `cpu' in lower case), sorted
505 on activity. Inactive cpu's will not be shown by default. The
506 lines showing the per-cpu occupation contain the cpu number in the
507 last field.
508 Every line contains the percentage of cpu time spent in kernel
510 mode by all active processes (`sys'), the percentage of cpu time
511 consumed in user mode (`user') for all active processes (including
512 processes running with a nice value larger than zero), the per‐
513 centage of cpu time spent for interrupt handling (`irq') including
514 softirq, the percentage of unused cpu time while no processes were
515 waiting for disk-I/O (`idle'), and the percentage of unused cpu
516 time while at least one process was waiting for disk-I/O (`wait').
517 In case of per-cpu occupation, the last column shows the cpu num‐
518 ber and the wait percentage (`w') for that cpu. The number of
519 lines showing the per-cpu occupation can be limited.
520 For virtual machines the steal-percentage is shown (`steal'),
522 reflecting the percentage of cpu time stolen by other virtual
523 machines running on the same hardware.
524 For physical machines hosting one or more virtual machines, the
525 guest-percentage is shown (`guest'), reflecting the percentage of
526 cpu time used by the virtual machines.
527 In case of frequency-scaling, all previously mentioned CPU-per‐
529 centages are relative to the used scaling of the CPU during the
530 interval. If e.g. a CPU has been active for 50% in user mode dur‐
531 ing the interval while the frequency-scaling of that was 40%, then
532 only 20% of the full capacity of the CPU has been used in user
533 mode.
534 In case that the kernel module `cpufreq_stats' is active (after
535 issueing `modprobe cpufreq_stats'), the average frequency (`avgf')
536 and the average scaling percentage (`avgscal') is shown. Otherwise
537 the current frequency (`curf') and the current scaling percentage
538 (`curscal') is shown at the moment that the sample is taken.
539 If the screen-width does not allow all of these counters, only a
541 relevant subset is shown.
542 CPL CPU load information.
544 This line contains the load average figures reflecting the number
545 of threads that are available to run on a CPU (i.e. part of the
546 runqueue) or that are waiting for disk I/O. These figures are
547 averaged over 1 (`avg1'), 5 (`avg5') and 15 (`avg15') minutes.
548 Furthermore the number of context switches (`csw'), the number of
549 serviced interrupts (`intr') and the number of available cpu's are
550 shown.
551 If the screen-width does not allow all of these counters, only a
553 relevant subset is shown.
554 MEM Memory occupation.
556 This line contains the total amount of physical memory (`tot'),
557 the amount of memory which is currently free (`free'), the amount
558 of memory in use as page cache (`cache'), the amount of memory
559 within the page cache that has to be flushed to disk (`dirty'),
560 the amount of memory used for filesystem meta data (`buff') and
561 the amount of memory being used for kernel malloc's (`slab' -
562 always 0 for kernel 2.4).
563 If the screen-width does not allow all of these counters, only a
565 relevant subset is shown.
566 SWP Swap occupation and overcommit info.
568 This line contains the total amount of swap space on disk (`tot')
569 and the amount of free swap space (`free').
570 Furthermore the committed virtual memory space (`vmcom') and the
571 maximum limit of the committed space (`vmlim', which is by default
572 swap size plus 50% of memory size) is shown. The committed space
573 is the reserved virtual space for all allocations of private mem‐
574 ory space for processes. The kernel only verifies whether the com‐
575 mitted space exceeds the limit if strict overcommit handling is
576 configured (vm.overcommit_memory is 2).
577 PAG Paging frequency.
579 This line contains the number of scanned pages (`scan') due to the
580 fact that free memory drops below a particular threshold and the
581 number times that the kernel tries to reclaim pages due to an
582 urgent need (`stall').
583 Also the number of memory pages the system read from swap space
584 (`swin') and the number of memory pages the system wrote to swap
585 space (`swout') are shown.
586 LVM/MDD/DSK
588 Logical volume/multiple device/disk utilization.
589 Per active unit one line is produced, sorted on unit activity.
590 Such line shows the name (e.g. VolGroup00-lvtmp for a logical vol‐
591 ume or sda for a hard disk), the busy percentage i.e. the portion
592 of time that the unit was busy handling requests (`busy'), the
593 number of read requests issued (`read'), the number of write
594 requests issued (`write'), the number of KiBytes per read
595 (`KiB/r'), the number of KiBytes per write (`KiB/w'), the number
596 of MiBytes per second throughput for reads (`MBr/s'), the number
597 of MiBytes per second throughput for writes (`MBw/s'), the average
598 queue depth (`avq') and the average number of milliseconds needed
599 by a request (`avio') for seek, latency and data transfer.
600 If the screen-width does not allow all of these counters, only a
601 relevant subset is shown.
602 The number of lines showing the units can be limited per class
604 (LVM, MDD or DSK) with the 'l' key or statically (see separate
605 man-page of atoprc). By specifying the value 0 for a particular
606 class, no lines will be shown any more for that class.
607 NET Network utilization (TCP/IP).
609 One line is shown for activity of the transport layer (TCP and
610 UDP), one line for the IP layer and one line per active interface.
611 For the transport layer, counters are shown concerning the number
612 of received TCP segments including those received in error
613 (`tcpi'), the number of transmitted TCP segments excluding those
614 containing only retransmitted octets (`tcpo'), the number of UDP
615 datagrams received (`udpi'), the number of UDP datagrams transmit‐
616 ted (`udpo'), the number of active TCP opens (`tcpao'), the number
617 of passive TCP opens (`tcppo'), the number of TCP output retrans‐
618 missions (`tcprs'), the number of TCP input errors (`tcpie'), the
619 number of TCP output resets (`tcpie'), the number of TCP output
620 retransmissions (`tcpor'), the number of UDP no ports (`udpnp'),
621 and the number of UDP input errors (`tcpie').
622 If the screen-width does not allow all of these counters, only a
623 relevant subset is shown.
624 These counters are related to IPv4 and IPv6 combined.
625 For the IP layer, counters are shown concerning the number of IP
627 datagrams received from interfaces, including those received in
628 error (`ipi'), the number of IP datagrams that local higher-layer
629 protocols offered for transmission (`ipo'), the number of received
630 IP datagrams which were forwarded to other interfaces (`ipfrw'),
631 the number of IP datagrams which were delivered to local higher-
632 layer protocols (`deliv'), the number of received ICMP datagrams
633 (`icmpi'), and the number of transmitted ICMP datagrams (`icmpo').
634 If the screen-width does not allow all of these counters, only a
635 relevant subset is shown.
636 These counters are related to IPv4 and IPv6 combined.
637 For every active network interface one line is shown, sorted on
639 the interface activity. Such line shows the name of the interface
640 and its busy percentage in the first column. The busy percentage
641 for half duplex is determined by comparing the interface speed
642 with the number of bits transmitted and received per second; for
643 full duplex the interface speed is compared with the highest of
644 either the transmitted or the received bits. When the interface
645 speed can not be determined (e.g. for the loopback interface),
646 `---' is shown instead of the percentage.
647 Furthermore the number of received packets (`pcki'), the number of
648 transmitted packets (`pcko'), the effective amount of bits
649 received per second (`si'), the effective amount of bits transmit‐
650 ted per second (`so'), the number of collisions (`coll'), the num‐
651 ber of received multicast packets (`mlti'), the number of errors
652 while receiving a packet (`erri'), the number of errors while
653 transmitting a packet (`erro'), the number of received packets
654 dropped (`drpi'), and the number of transmitted packets dropped
655 (`drpo').
656 If the screen-width does not allow all of these counters, only a
657 relevant subset is shown.
658 The number of lines showing the network interfaces can be limited.
659
661 Following the system level information, the processes are shown from
662 which the resource utilization has changed during the last interval.
663 These processes might have used cpu time or issued disk- or network
664 requests. However a process is also shown if part of it has been paged
665 out due to lack of memory (while the process itself was in sleep
666 state).
667 Per process the following fields may be shown (in alphabetical order),
669 depending on the current output mode as described in the section INTER‐
670 ACTIVE COMMANDS and depending on the current width of your window:
671 AVGRSZ The average size of one read-action on disk.
673 AVGWSZ The average size of one write-action on disk.
675 CMD The name of the process. This name can be surrounded by
677 "less/greater than" signs (`<name>') which means that the
678 process has finished during the last interval.
679 Behind the abbreviation `CMD' in the header line, the current
680 page number and the total number of pages of the process list
681 are shown.
682 COMMAND-LINE
684 The full command line of the process (including arguments),
685 which is limited to the length of the screen line. Th command
686 line can be surrounded by "less/greater than" signs (`<line>')
687 which means that the process has finished during the last
688 interval.
689 Behind the verb `COMMAND-LINE' in the header line, the current
690 page number and the total number of pages of the process list
691 are shown.
692 CPU The occupation percentage of this process related to the
694 available capacity for this resource on system level.
695 CPUNR The identification of the CPU the main thread of the process
697 is running on or has recently been running on.
698 DSK The occupation percentage of this process related to the total
700 load that is produced by all processes (i.e. total disk
701 accesses by all processes during the last interval).
702 This information is shown when per process "storage account‐
703 ing" is active in the kernel or when the kernel patch `cnt'
704 has been installed.
705 EGID Effective group-id under which this process executes.
707 ENDATE Date that the process has been finished. If the process is
709 still running, this field shows `active'.
710 ENTIME Time that the process has been finished. If the process is
712 still running, this field shows `active'.
713 EUID Effective user-id under which this process executes.
715 EXC The exit code of a terminated process (second position of col‐
717 umn `ST' is E) or the fatal signal number (second position of
718 column `ST' is S or C).
719 FSGID Filesystem group-id under which this process executes.
721 FSUID Filesystem user-id under which this process executes.
723 MAJFLT The number of page faults issued by this process that have
725 been solved by creating/loading the requested memory page.
726 MEM The occupation percentage of this process related to the
728 available capacity for this resource on system level.
729 MINFLT The number of page faults issued by this process that have
731 been solved by reclaiming the requested memory page from the
732 free list of pages.
733 NET The occupation percentage of this process related to the total
735 load that is produced by all processes (i.e. network packets
736 transferred by all processes during the last interval).
737 This information can only be shown when kernel patch `cnt' is
738 installed.
739 NICE The more or less static priority that can be given to a proces
741 on a scale from -20 (high priority) to +19 (low priority).
742 NPROCS The number of active and terminated processes accumulated for
744 this user or program.
745 PID Process-id. If a process has been started and finished during
747 the last interval, a `?' is shown because the process-id is
748 not part of the standard process accounting record. However
749 when the kernel patch `acct' is installed, this value will be
750 shown properly.
751 POLI The policies 'norm' (normal, which is SCHED_OTHER), 'btch'
753 (batch) and 'idle' refer to timesharing processes. The poli‐
754 cies 'fifo' (SCHED_FIFO) and 'rr' (round robin, which is
755 SCHED_RR) refer to realtime processes.
756 PPID Parent process-id. If a process has been started and finished
758 during the last interval, value 0 is shown because the parent
759 process-id is not part of the standard process accounting
760 record. However when the kernel patch `acct' is installed,
761 this value will be shown properly.
762 PRI The process' priority ranges from 0 (highest priority) to 139
764 (lowest priority). Priority 0 to 99 are used for realtime pro‐
765 cesses (fixed priority independent of their behavior) and pri‐
766 ority 100 to 139 for timesharing processes (variable priority
767 depending on their recent CPU consumption and the nice value).
768 RAWRCV The number of raw datagrams received by this process. This
770 information can only be shown when kernel patch `cnt' is
771 installed.
772 If a process has finished during the last interval, no value
773 is shown since network counters are not registered in the
774 standard process accounting record. However when the kernel
775 patch `acct' is installed, this value will be shown.
776 RAWSND The number of raw datagrams sent by this process. This infor‐
778 mation can only be shown when kernel patch `cnt' is installed.
779 If a process has finished during the last interval, no value
780 is shown since network counters are not registered in the
781 standard process accounting record. However when the kernel
782 patch `acct' is installed, this value will be shown.
783 RDDSK When the kernel maintains standard io statistics (>= 2.6.20):
785 The read data transfer issued physically on disk (so reading
786 from the disk cache is not accounted for).
787 When the kernel patch `cnt' is installed:
789 The number of read accesses issued physically on disk (so
790 reading from the disk cache is not accounted for).
791 RGID The real group-id under which the process executes.
793 RGROW The amount of resident memory that the process has grown dur‐
795 ing the last interval. A resident growth can be caused by
796 touching memory pages which were not physically created/loaded
797 before (load-on-demand). Note that a resident growth can also
798 be negative e.g. when part of the process is paged out due to
799 lack of memory or when the process frees dynamically allocated
800 memory. For a process which started during the last interval,
801 the resident growth reflects the total resident size of the
802 process at that moment.
803 If a process has finished during the last interval, no value
804 is shown since resident memory occupation is not part of the
805 standard process accounting record. However when the kernel
806 patch `acct' is installed, this value will be shown.
807 RNET The number of TCP- and UDP packets received by this process.
809 This information can only be shown when kernel patch `cnt' is
810 installed.
811 If a process has finished during the last interval, no value
812 is shown since network counters are not part of the standard
813 process accounting record. However when the kernel patch
814 `acct' is installed, this value will be shown.
815 RSIZE The total resident memory usage consumed by this process (or
817 user).
818 If a process has finished during the last interval, no value
819 is shown since resident memory occupation is not part of the
820 standard process accounting record. However when the kernel
821 patch `acct' is installed, this value will be shown.
822 RTPR Realtime priority according the POSIX standard. Value can be
824 0 for a timesharing process (policy 'norm', 'btch' or 'idle')
825 or ranges from 1 (lowest) till 99 (highest) for a realtime
826 process (policy 'rr' or 'fifo').
827 RUID The real user-id under which the process executes.
829 S The current state of the main thread of the process: `R' for
831 running (currently processing or in the runqueue), `S' for
832 sleeping interruptible (wait for an event to occur), `D' for
833 sleeping non-interruptible, `Z' for zombie (waiting to be syn‐
834 chronized with its parent process), `T' for stopped (suspended
835 or traced), `W' for swapping, and `E' (exit) for processes
836 which have finished during the last interval.
837 SGID The saved group-id of the process.
839 SNET The number of TCP- and UDP packets transmitted by this
841 process. This information can only be shown when kernel patch
842 `cnt' is installed.
843 If a process has finished during the last interval, no value
844 is shown since network-counters are not part of the standard
845 process accounting record. However when the kernel patch
846 `acct' is installed, this value will be shown.
847 ST The status of a process.
849 The first position indicates if the process has been started
850 during the last interval (the value N means 'new process').
851 The second position indicates if the process has been finished
853 during the last interval.
854 The value E means 'exit' on the process' own initiative; the
855 exit code is displayed in the column `EXC'.
856 The value S means that the process has been terminated unvol‐
857 untarily by a signal; the signal number is displayed in the in
858 the column `EXC'.
859 The value C means that the process has been terminated unvol‐
860 untarily by a signal, producing a core dump in its current
861 directory; the signal number is displayed in the column `EXC'.
862 STDATE The start date of the process.
864 STTIME The start time of the process.
866 SUID The saved user-id of the process.
868 SYSCPU CPU time consumption of this process in system mode (kernel
870 mode), usually due to system call handling.
871 TCPRASZ The average size of a received TCP buffer in bytes (by the
873 process). This information can only be shown when kernel
874 patch `cnt' is installed. When the kernel patch `acct' is
875 installed as well, this value will also be shown when a
876 process has finished during the last interval.
877 TCPRCV The number of receive requests issued by this process for TCP
879 sockets. This information can only be shown when kernel patch
880 `cnt' is installed. When the kernel patch `acct' is installed
881 as well, this value will also be shown when a process has fin‐
882 ished during the last interval.
883 TCPSASZ The average size of a transmitted TCP buffer in bytes (by the
885 process). This information can only be shown when kernel
886 patch `cnt' is installed. When the kernel patch `acct' is
887 installed as well, this value will also be shown when a
888 process has finished during the last interval.
889 TCPSND The number of send requests issued by this process for TCP
891 sockets, and the average size per transfer in bytes. This
892 information can only be shown when kernel patch `cnt' is
893 installed. When the kernel patch `acct' is installed as well,
894 this value will also be shown when a process has finished dur‐
895 ing the last interval.
896 THR Total number of threads within this process. All related
898 threads are contained in a thread group, represented by atop
899 as one line.
900 On Linux 2.4 systems it is hardly possible to determine which
902 threads (i.e. processes) are related to the same thread group.
903 Every thread is represented by atop as a separate line.
904 TOTRSZ The total amount of data physically read from disk. This
906 information can only be shown when kernel patch `cnt' is
907 installed.
908 TOTWSZ The total amount of data physically written to disk. This
910 information can only be shown when kernel patch `cnt' is
911 installed.
912 TRUN Number of threads within this process that are in the state
914 'running' (R).
915 TSLPI Number of threads within this process that are in the state
917 'interruptible sleeping' (S).
918 TSLPU Number of threads within this process that are in the state
920 'uninterruptible sleeping' (D).
921 UDPRASZ The average size of a received UDP packet in bytes. This
923 information can only be shown when kernel patch `cnt' is
924 installed. When the kernel patch `acct' is installed as well,
925 this value will also be shown when a process has finished dur‐
926 ing the last interval.
927 UDPRCV The number of receive requests issued by this process for UDP
929 sockets. This information can only be shown when kernel patch
930 `cnt' is installed. When the kernel patch `acct' is installed
931 as well, this value will also be shown when a process has fin‐
932 ished during the last interval.
933 UDPSASZ The average size of a transmitted UDP packets in bytes. This
935 information can only be shown when kernel patch `cnt' is
936 installed. When the kernel patch `acct' is installed as well,
937 this value will also be shown when a process has finished dur‐
938 ing the last interval.
939 UDPSND The number of send requests issued by this process for TCP
941 sockets, and the average size per transfer in bytes. This
942 information can only be shown when kernel patch `cnt' is
943 installed. When the kernel patch `acct' is installed as well,
944 this value will also be shown when a process has finished dur‐
945 ing the last interval.
946 USRCPU CPU time consumption of this process in user mode, due to pro‐
948 cessing the own program text.
949 VGROW The amount of virtual memory that the process has grown during
951 the last interval. A virtual growth can be caused by e.g.
952 issueing a malloc() or attaching a shared memory segment. Note
953 that a virtual growth can also be negative by e.g. issueing a
954 free() or detaching a shared memory segment. For a process
955 which started during the last interval, the virtual growth
956 reflects the total virtual size of the process at that moment.
957 If a process has finished during the last interval, no value
958 is shown since virtual memory occupation is not part of the
959 standard process accounting record. However when the kernel
960 patch `acct' is installed, this value will be shown.
961 VSIZE The total virtual memory usage consumed by this process (or
963 user).
964 If a process has finished during the last interval, no value
965 is shown since virtual memory occupation is not part of the
966 standard process accounting record. However when the kernel
967 patch `acct' is installed, this value will be shown.
968 VSTEXT The virtual memory size used by the shared text of this
970 process.
971 WRDSK When the kernel maintains standard io statistics (>= 2.6.20):
973 The write data transfer issued physically on disk (so writing
974 to the disk cache is not accounted for). This counter is
975 maintained for the application process that writes its data to
976 the cache (assuming that this data is physically transferred
977 to disk later on). Notice that disk I/O needed for swapping is
978 not taken into account.
979 When the kernel patch `cnt' is installed:
981 The number of write accesses issued physically on disk (so
982 writing to the disk cache is not accounted for). Usually
983 application processes just transfer their data to the cache,
984 while the physical write accesses are done later on by kernel
985 daemons like pdflush. Note that the number read- and write
986 accesses are not separately maintained in the standard process
987 accounting record. This means that only one value is given
988 for read's and write's in case a process has finished during
989 the last interval. However when the kernel patch `acct' is
990 installed, these values will be shown separately.
991 WCANCL When the kernel patch `cnt' is not installed, but the kernel
993 maintains standard io statistics (>= 2.6.20):
994 The write data transfer previously accounted for this process
995 or another process that has been cancelled. Suppose that a
996 process writes new data to a file and that data is removed
997 again before the cache buffers have been flushed to disk.
998 Then the original process shows the written data as WRDSK,
999 while the process that removes/truncates the file shows the
1000 unflushed removed data as WCANCL.
1001
1003 With the flag -P followed by a list of one or more labels (comma-sepa‐
1004 rated), parseable output is produced for each sample. The labels that
1005 can be specified for system-level statistics correspond to the labels
1006 (first verb of each line) that can be found in the interactive output:
1007 "CPU", "cpu" "CPL" "MEM", "SWP", "PAG", "LVM", "MDD", "DSK" and "NET".
1008 For process-level statistics special labels are introduced: "PRG" (gen‐
1009 eral), "PRC" (cpu), "PRM" (memory), "PRD" (disk, only if the kernel-
1010 patch has been installed) and "PRN" (network, only if the kernel-patch
1011 has been installed).
1012 With the label "ALL", all system- and process-level statistics are
1013 shown.
1014 For every interval all requested lines are shown whereafter atop shows
1016 a line just containing the label "SEP" as a separator before the lines
1017 for the next sample are generated.
1018 When a sample contains the values since boot, atop shows a line just
1019 containing the label "RESET" before the lines for this sample are gen‐
1020 erated.
1021 The first part of each output-line consists of the following six
1023 fields: label (the name of the label), host (the name of this machine),
1024 epoch (the time of this interval as number of seconds since 1-1-1970),
1025 date (date of this interval in format YYYY/MM/DD), time (time of this
1026 interval in format HH:MM:SS), and interval (number of seconds elapsed
1027 for this interval).
1028 The subsequent fields of each output-line depend on the label:
1030 CPU Subsequent fields: total number of clock-ticks per second for
1032 this machine, number of processors, consumption for all CPU's
1033 in system mode (clock-ticks), consumption for all CPU's in
1034 user mode (clock-ticks), consumption for all CPU's in user
1035 mode for niced processes (clock-ticks), consumption for all
1036 CPU's in idle mode (clock-ticks), consumption for all CPU's in
1037 wait mode (clock-ticks), consumption for all CPU's in irq mode
1038 (clock-ticks), consumption for all CPU's in softirq mode
1039 (clock-ticks), consumption for all CPU's in steal mode (clock-
1040 ticks), and consumption for all CPU's in guest mode (clock-
1041 ticks).
1042 cpu Subsequent fields: total number of clock-ticks per second for
1044 this machine, processor-number, consumption for this CPU in
1045 system mode (clock-ticks), consumption for this CPU in user
1046 mode (clock-ticks), consumption for this CPU in user mode for
1047 niced processes (clock-ticks), consumption for this CPU in
1048 idle mode (clock-ticks), consumption for this CPU in wait mode
1049 (clock-ticks), consumption for this CPU in irq mode (clock-
1050 ticks), consumption for this CPU in softirq mode (clock-
1051 ticks), consumption for this CPU in steal mode (clock-ticks),
1052 and consumption for this CPU in guest mode (clock-ticks).
1053 CPL Subsequent fields: number of processors, load average for last
1055 minute, load average for last five minutes, load average for
1056 last fifteen minutes, number of context-switches, and number
1057 of device interrupts.
1058 MEM Subsequent fields: page size for this machine (in bytes), size
1060 of physical memory (pages), size of free memory (pages), size
1061 of page cache (pages), size of buffer cache (pages), size of
1062 slab (pages), and number of dirty pages in cache.
1063 SWP Subsequent fields: page size for this machine (in bytes), size
1065 of swap (pages), size of free swap (pages), 0 (future use),
1066 size of committed space (pages), and limit for committed space
1067 (pages).
1068 PAG Subsequent fields: page size for this machine (in bytes), num‐
1070 ber of page scans, number of allocstalls, 0 (future use), num‐
1071 ber of swapins, and number of swapouts.
1072 LVM/MDD/DSK
1074 For every logical volume/multiple device/hard disk one line is
1075 shown.
1076 Subsequent fields: name, number of milliseconds spent for I/O,
1077 number of reads issued, number of sectors transferred for
1078 reads, number of writes issued, and number of sectors trans‐
1079 ferred for write.
1080 NET First one line is produced for the upper layers of the TCP/IP
1082 stack.
1083 Subsequent fields: the verb "upper", number of packets
1084 received by TCP, number of packets transmitted by TCP, number
1085 of packets received by UDP, number of packets transmitted by
1086 UDP, number of packets received by IP, number of packets
1087 transmitted by IP, number of packets delivered to higher lay‐
1088 ers by IP, and number of packets forwarded by IP.
1089 Next one line is shown for every interface.
1091 Subsequent fields: name of the interface, number of packets
1092 received by the interface, number of bytes received by the
1093 interface, number of packets transmitted by the interface,
1094 number of bytes transmitted by the interface, interface speed,
1095 and duplex mode (0=half, 1=full).
1096 PRG For every process one line is shown.
1098 Subsequent fields: PID, name (between brackets), state, real
1099 uid, real gid, TGID (same as PID), total number of threads,
1100 exit code, start time (epoch), full command line (between
1101 brackets), PPID, number of threads in state 'running' (R),
1102 number of threads in state 'interruptible sleeping' (S), num‐
1103 ber of threads in state 'uninterruptible sleeping' (D), effec‐
1104 tive uid, effective gid, saved uid, saved gid, filesystem uid,
1105 filesystem gid, and elapsed time (hertz).
1106 PRC For every process one line is shown.
1108 Subsequent fields: PID, name (between brackets), state, total
1109 number of clock-ticks per second for this machine, CPU-con‐
1110 sumption in user mode (clockticks), CPU-consumption in system
1111 mode (clockticks), nice value, priority, realtime priority,
1112 scheduling policy, current CPU, and sleep average.
1113 PRM For every process one line is shown.
1115 Subsequent fields: PID, name (between brackets), state, page
1116 size for this machine (in bytes), virtual memory size
1117 (Kbytes), resident memory size (Kbytes), shared text memory
1118 size (Kbytes), virtual memory growth (Kbytes), resident memory
1119 growth (Kbytes), number of minor page faults, and number of
1120 major page faults.
1121 PRD For every process one line is shown.
1123 Subsequent fields: PID, name (between brackets), state, ker‐
1124 nel-patch installed ('y' or 'n'), standard io statistics used
1125 ('y' or 'n'), number of reads on disk, cumulative number of
1126 sectors read, number of writes on disk, cumulative number of
1127 sectors written, and cancelled number of written sectors.
1128 If the kernel patch is not installed and the standard I/O sta‐
1129 tistics (>= 2.6.20) are not used, the disk I/O counters per
1130 process are not relevant. When the kernel patch is installed,
1131 the counter 'cancelled number of written sectors' is not rele‐
1132 vant. When only the standard io statistics are used, the
1133 counters 'number of reads on disk' and 'number of writes on
1134 disk' are not relevant.
1135 PRN For every process one line is shown.
1137 Subsequent fields: PID, name (between brackets), state, ker‐
1138 nel-patch installed ('y' or 'n'), number of TCP-packets trans‐
1139 mitted, cumulative size of TCP-packets transmitted, number of
1140 TCP-packets received, cumulative size of TCP-packets received,
1141 number of UDP-packets transmitted, cumulative size of UDP-
1142 packets transmitted, number of UDP-packets received, cumula‐
1143 tive size of UDP-packets transmitted, number of raw packets
1144 transmitted, and number of raw packets received.
1145 If the kernel patch is not installed, the network I/O counters
1146 per process are not relevant.
1147
1149 To monitor the current system load interactively with an interval of 5
1150 seconds:
1151 atop 5
1153 To monitor the system load and write it to a file (in plain ASCII) with
1155 an interval of one minute during half an hour with active processes
1156 sorted on memory consumption:
1157 atop -M 60 30 > /log/atop.mem
1159 Store information about the system- and process activity in binary com‐
1161 pressed form to a file with an interval of ten minutes during an hour:
1162 atop -w /tmp/atop.raw 600 6
1164 View the contents of this file interactively:
1166 atop -r /tmp/atop.raw
1168 View the processor- and disk-utilization of this file in parseable for‐
1170 mat:
1171 atop -PCPU,DSK -r /tmp/atop.raw
1173 View the contents of today's standard logfile interactively:
1175 atop -r
1177 View the contents of the standard logfile of the day before yesterday
1179 interactively:
1180 atop -r yy
1182 View the contents of the standard logfile of 2010, January 7 from 02:00
1184 PM onwards interactively:
1185 atop -r 20100107 -b 14:00
1187
1189 /tmp/atop.d/atop.acct
1190 File in which the kernel writes the accounting records if the
1191 standard accounting to the file /var/log/pacct or
1192 /var/account/pacct is not used.
1193 /etc/atoprc
1195 Configuration file containing system-wide default values. See
1196 related man-page.
1197 ~/.atoprc
1199 Configuration file containing personal default values. See
1200 related man-page.
1201 /var/log/atop/atop_YYYYMMDD
1203 Raw file, where YYYYMMDD are digits representing the current date.
1204 This name is used by the script atop.daily as default name for the
1205 output file, and by atop as default name for the input file when
1206 using the -r flag.
1207 All binary system- and process-level data in this file has been
1208 stored in compressed format.
1209
1211 atopsar(1), atoprc(5), logrotate(8)
1212 http://www.atoptool.nl
1213
1215 Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
1216 JC van Winkel (jc@ATComputing.nl)
1217AT Computing April 2010 ATOP(1)