1ATOP(1) General Commands Manual ATOP(1)
2
6 atop - Advanced System & Process Monitor
7
9 Interactive Usage:
10 atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y] [-C|-M|-D|-N|-A] [-afFG1xR] [-L
12 linelen] [-Plabel[,label]...] [ interval [ samples ]]
13 Writing and reading raw logfiles:
15 atop -w rawfile [-a] [-S] [ interval [ samples ]]
17 atop -r [ rawfile ] [-b hh:mm ] [-e hh:mm ]
18 [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y] [-C|-M|-D|-N|-A] [-fFG1xR] [-L line‐
19 len] [-Plabel[,label]...]
20
22 The program atop is an interactive monitor to view the load on a Linux
23 system. It shows the occupation of the most critical hardware
24 resources (from a performance point of view) on system level, i.e. cpu,
25 memory, disk and network.
26 It also shows which processes are responsible for the indicated load
27 with respect to cpu and memory load on process level. Disk load is
28 shown per process if "storage accounting" is active in the kernel.
29 Network load is shown per process if the kernel module `netatop' has
30 been installed.
31 Every interval (default: 10 seconds) information is shown about the
33 resource occupation on system level (cpu, memory, disks and network
34 layers), followed by a list of processes which have been active during
35 the last interval (note that all processes that were unchanged during
36 the last interval are not shown, unless the key 'a' has been pressed or
37 unless sorting on memory occupation is done). If the list of active
38 processes does not entirely fit on the screen, only the top of the list
39 is shown (sorted in order of activity).
40 The intervals are repeated till the number of samples (specified as
41 command argument) is reached, or till the key 'q' is pressed in inter‐
42 active mode.
43 When atop is started, it checks whether the standard output channel is
45 connected to a screen, or to a file/pipe. In the first case it produces
46 screen control codes (via the ncurses library) and behaves interac‐
47 tively; in the second case it produces flat ASCII-output.
48 In interactive mode, the output of atop scales dynamically to the cur‐
50 rent dimensions of the screen/window.
51 If the window is resized horizontally, columns will be added or removed
52 automatically. For this purpose, every column has a particular weight.
53 The columns with the highest weights that fit within the current width
54 will be shown.
55 If the window is resized vertically, lines of the process/thread list
56 will be added or removed automatically.
57 Furthermore in interactive mode the output of atop can be controlled by
59 pressing particular keys. However it is also possible to specify such
60 key as flag on the command line. In that case atop switches to the
61 indicated mode on beforehand; this mode can be modified again interac‐
62 tively. Specifying such key as flag is especially useful when running
63 atop with output to a pipe or file (non-interactively). These flags
64 are the same as the keys that can be pressed in interactive mode (see
65 section INTERACTIVE COMMANDS).
66 Additional flags are available to support storage of atop-data in raw
67 format (see section RAW DATA STORAGE).
68
70 With every interval, atop reads the kernel administration to obtain
71 information about all running processes. However, it is likely that
72 during the interval also processes have terminated. These processes
73 might have consumed system resources during this interval as well
74 before they terminated. Therefor, atop tries to read the process
75 accounting records that contain the accounting information of termi‐
76 nated processes and report these processes too. Only when the process
77 accounting mechanism in the kernel is activated, the kernel writes such
78 process accounting record to a file for every process that terminates.
79 There are various ways for atop to get access to the process accounting
81 records (tried in this order):
82 1. When the environment variable ATOPACCT is set, it specifies the
84 name of the process accounting file. In that case, process
85 accounting for this file should have been activated on beforehand.
86 Before opening this file for reading, atop drops its root privi‐
87 leges (if any).
88 When this environment variable is present but its contents is
89 empty, process accounting will not be used at all.
90 2. This is the preferred way of handling process accounting records!
92 When the atopacctd daemon is active, it has activated the process
93 accounting mechanism in the kernel and transfers to original
94 accounting records to shadow files. In that case, atop drops its
95 root privileges and opens the current shadow file for reading.
96 This way is preferred, because the atopacctd daemon maintains full
97 control of the sizes of the original process accounting file (writ‐
98 ten by the kernel) and the shadow files (read by the atop pro‐
99 cesses). For further information, refer to the atopacctd man page.
100 3. When the atopacctd daemon is not active, atop verifies if the
102 process accounting mechanism has been switched on via the separate
103 psacct package. In that case, the file /var/account/pacct is in use
104 as process accounting file and atop opens this file for reading.
105 4. As a last possibility, atop itself tries to activate the process
107 accounting mechanism (requires root privileges) using the file
108 /var/cache/atop.d/atop.acct (to be written by the kernel, to be
109 read by atop itself). Process accounting remains active as long as
110 at least one atop process is alive. Whenever the last atop process
111 stops (either by pressing `q' or by `kill -15'), it deactivates the
112 process accounting mechanism again. Therefor you should never ter‐
113 minate atop by `kill -9', because then it has no chance to stop
114 process accounting. As a result, the accounting file may consume a
115 lot of disk space after a while.
116 To avoid that the process accounting file consumes too much disk
117 space, atop verifies at the end of every sample if the size of the
118 process accounting file exceeds 200 MiB and if this atop process is
119 the only one that is currently using the file. In that case the
120 file is truncated to a size of zero.
121 Notice that root-privileges are required to switch on/off process
123 accounting in the kernel. You can start atop as a root user or
124 specify setuid-root privileges to the executable file. In the lat‐
125 ter case, atop switches on process accounting and drops the root-
126 privileges again.
127 If atop does not run with root-privileges, it does not show infor‐
128 mation about finished processes. It indicates this situation with
129 the message message `no procacct` in the top-right corner (instead
130 of the counter that shows the number of exited processes).
131 When during one interval a lot of processes have finished, atop might
133 grow tremendously in memory when reading all process accounting records
134 at the end of the interval. To avoid such excessive growth, atop will
135 never read more than 50 MiB with process information from the process
136 accounting file per interval (approx. 70000 finished processes). In
137 interactive mode a warning is given whenever processes have been
138 skipped for this reason.
139
141 For the resource consumption on system level, atop uses colors to indi‐
142 cate that a critical occupation percentage has been (almost) reached.
143 A critical occupation percentage means that is likely that this load
144 causes a noticeable negative performance influence for applications
145 using this resource. The critical percentage depends on the type of
146 resource: e.g. the performance influence of a disk with a busy percent‐
147 age of 80% might be more noticeable for applications/user than a CPU
148 with a busy percentage of 90%.
149 Currently atop uses the following default values to calculate a
150 weighted percentage per resource:
151 Processor
153 A busy percentage of 90% or higher is considered `critical'.
154 Disk
156 A busy percentage of 70% or higher is considered `critical'.
157 Network
159 A busy percentage of 90% or higher for the load of an interface is
160 considered `critical'.
161 Memory
163 An occupation percentage of 90% is considered `critical'. Notice
164 that this occupation percentage is the accumulated memory consump‐
165 tion of the kernel (including slab) and all processes; the memory
166 for the page cache (`cache' and `buff' in the MEM-line) and the
167 reclaimable part of the slab (`slrec`) is not implied!
168 If the number of pages swapped out (`swout' in the PAG-line) is
169 larger than 10 per second, the memory resource is considered
170 `critical'. A value of at least 1 per second is considered
171 `almost critical'.
172 If the committed virtual memory exceeds the limit (`vmcom' and
173 `vmlim' in the SWP-line), the SWP-line is colored due to overcom‐
174 mitting the system.
175 Swap
177 An occupation percentage of 80% is considered `critical' because
178 swap space might be completely exhausted in the near future; it is
179 not critical from a performance point-of-view.
180 These default values can be modified in the configuration file (see
182 separate man-page of atoprc).
183 When a resource exceeds its critical occupation percentage, the con‐
185 cerning values in the screen line are colored red by default.
186 When a resource exceeded (default) 80% of its critical percentage (so
187 it is almost critical), the concerning values in the screen line are
188 colored cyan by default. This `almost critical percentage' (one value
189 for all resources) can be modified in the configuration file (see sepa‐
190 rate man-page of atoprc).
191 The default colors red and cyan can be modified in the configuration
192 file as well (see separate man-page of atoprc).
193 With the key 'x' (or flag -x), the use of colors can be suppressed.
195
197 Per-process and per-thread network activity can be measured by the
198 netatop kernel module. You can download this kernel module from the
199 website (mentioned at the end of this manual page) and install it on
200 your system if the kernel version is 2.6.24 or newer.
201 When atop gathers counters for a new interval, it verifies if the
202 netatop module is currently active. If so, atop obtains the relevant
203 network counters from this module and shows the number of sent and
204 received packets per process/thread in the generic screen. Besides,
205 detailed counters can be requested by pressing the `n' key.
206 When the netatopd daemon is running as well, atop also reads the net‐
207 work counters of exited processes that are logged by this daemon (com‐
208 parable with process accounting).
209 More information about the optional netatop kernel module and the
211 netatopd daemon can be found in the concerning man-pages and on the
212 website mentioned at the end of this manual page.
213
215 When running atop interactively (no output redirection), keys can be
216 pressed to control the output. In general, lower case keys can be used
217 to show other information for the active processes and upper case keys
218 can be used to influence the sort order of the active process/thread
219 list.
220 g Show generic output (default).
222 Per process the following fields are shown in case of a window-
224 width of 80 positions: process-id, cpu consumption during the last
225 interval in system and user mode, the virtual and resident memory
226 growth of the process.
227 The subsequent columns depend on the used kernel:
229 When the kernel supports "storage accounting" (>= 2.6.20), the
230 data transfer for read/write on disk, the status and exit code are
231 shown for each process. When the kernel does not support "storage
232 accounting", the username, number of threads in the thread group,
233 the status and exit code are shown.
234 When the kernel module 'netatop' is loaded, the data transfer for
235 send/receive of network packets is shown for each process.
236 The last columns contain the state, the occupation percentage for
237 the chosen resource (default: cpu) and the process name.
238 When more than 80 positions are available, other information is
240 added.
241 m Show memory related output.
243 Per process the following fields are shown in case of a window-
245 width of 80 positions: process-id, minor and major memory faults,
246 size of virtual shared text, total virtual process size, total
247 resident process size, virtual and resident growth during last
248 interval, memory occupation percentage and process name.
249 When more than 80 positions are available, other information is
251 added.
252 For memory consumption, always all processes are shown (also the
254 processes that were not active during the interval).
255 d Show disk-related output.
257 When "storage accounting" is active in the kernel, the following
259 fields are shown: process-id, amount of data read from disk,
260 amount of data written to disk, amount of data that was written
261 but has been withdrawn again (WCANCL), disk occupation percentage
262 and process name.
263 n Show network related output.
265 Per process the following fields are shown in case of a window-
267 width of 80 positions: process-id, thread-id, total bandwidth for
268 received packets, total bandwidth for sent packets, number of
269 received TCP packets with the average size per packet (in bytes),
270 number of sent TCP packets with the average size per packet (in
271 bytes), number of received UDP packets with the average size per
272 packet (in bytes), number of sent UDP packets with the average
273 size per packet (in bytes), the network occupation percentage and
274 process name.
275 This information can only be shown when kernel module `netatop' is
276 installed.
277 When more than 80 positions are available, other information is
279 added.
280 s Show scheduling characteristics.
282 Per process the following fields are shown in case of a window-
284 width of 80 positions: process-id, number of threads in state
285 'running' (R), number of threads in state 'interruptible sleeping'
286 (S), number of threads in state 'uninterruptible sleeping' (D),
287 scheduling policy (normal timesharing, realtime round-robin, real‐
288 time fifo), nice value, priority, realtime priority, current pro‐
289 cessor, status, exit code, state, the occupation percentage for
290 the chosen resource and the process name.
291 When more than 80 positions are available, other information is
293 added.
294 v Show various process characteristics.
296 Per process the following fields are shown in case of a window-
298 width of 80 positions: process-id, user name and group, start date
299 and time, status (e.g. exit code if the process has finished),
300 state, the occupation percentage for the chosen resource and the
301 process name.
302 When more than 80 positions are available, other information is
304 added.
305 c Show the command line of the process.
307 Per process the following fields are shown: process-id, the occu‐
309 pation percentage for the chosen resource and the command line
310 including arguments.
311 o Show the user-defined line of the process.
313 In the configuration file the keyword ownprocline can be specified
315 with the description of a user-defined output-line.
316 Refer to the man-page of atoprc for a detailed description.
317 y Show the individual threads within a process (toggle).
319 Single-threaded processes are still shown as one line.
321 For multi-threaded processes, one line represents the process
322 while additional lines show the activity per individual thread (in
323 a different color). Depending on the option 'a' (all or active
324 toggle), all threads are shown or only the threads that were
325 active during the last interval.
326 Whether this key is active or not can be seen in the header line.
327 u Show the process activity accumulated per user.
329 Per user the following fields are shown: number of processes
331 active or terminated during last interval (or in total if combined
332 with command `a'), accumulated cpu consumption during last inter‐
333 val in system and user mode, the current virtual and resident mem‐
334 ory space consumed by active processes (or all processes of the
335 user if combined with command `a').
336 When "storage accounting" is active in the kernel, the accumulated
337 read and write throughput on disk is shown. When the kernel mod‐
338 ule `netatop' has been installed, the number of received and sent
339 network packets are shown.
340 The last columns contain the accumulated occupation percentage for
341 the chosen resource (default: cpu) and the user name.
342 p Show the process activity accumulated per program (i.e. process
344 name).
345 Per program the following fields are shown: number of processes
347 active or terminated during last interval (or in total if combined
348 with command `a'), accumulated cpu consumption during last inter‐
349 val in system and user mode, the current virtual and resident mem‐
350 ory space consumed by active processes (or all processes of the
351 user if combined with command `a').
352 When "storage accounting" is active in the kernel, the accumulated
353 read and write throughput on disk is shown. When the kernel mod‐
354 ule `netatop' has been installed, the number of received and sent
355 network packets are shown.
356 The last columns contain the accumulated occupation percentage for
357 the chosen resource (default: cpu) and the program name.
358 j Show the process activity accumulated per Docker container.
360 Per container the following fields are shown: number of processes
362 active or terminated during last interval (or in total if combined
363 with command `a'), accumulated cpu consumption during last inter‐
364 val in system and user mode, the current virtual and resident mem‐
365 ory space consumed by active processes (or all processes of the
366 user if combined with command `a').
367 When "storage accounting" is active in the kernel, the accumulated
368 read and write throughput on disk is shown. When the kernel mod‐
369 ule `netatop' has been installed, the number of received and sent
370 network packets are shown.
371 The last columns contain the accumulated occupation percentage for
372 the chosen resource (default: cpu) and the Docker container id
373 (CID).
374 C Sort the current list in the order of cpu consumption (default).
376 The one-but-last column changes to ``CPU''.
377 M Sort the current list in the order of resident memory consumption.
379 The one-but-last column changes to ``MEM''. In case of sorting on
380 memory, the full process list will be shown (not only the active
381 processes).
382 D Sort the current list in the order of disk accesses issued. The
384 one-but-last column changes to ``DSK''.
385 N Sort the current list in the order of network bandwidth (received
387 and transmitted). The one-but-last column changes to ``NET''.
388 A Sort the current list automatically in the order of the most busy
390 system resource during this interval. The one-but-last column
391 shows either ``ACPU'', ``AMEM'', ``ADSK'' or ``ANET'' (the preced‐
392 ing 'A' indicates automatic sorting-order). The most busy
393 resource is determined by comparing the weighted busy-percentages
394 of the system resources, as described earlier in the section COL‐
395 ORS.
396 This option remains valid until another sorting-order is explic‐
397 itly selected again.
398 A sorting-order for disk is only possible when "storage account‐
399 ing" is active. A sorting-order for network is only possible when
400 the kernel module `netatop' is loaded.
401 Miscellaneous interactive commands:
403 ? Request for help information (also the key 'h' can be pressed).
405 V Request for version information (version number and date).
407 R Gather and calculate the proportional set size of processes (tog‐
409 gle). Gathering of all values that are needed to calculate the
410 PSIZE of a process is a relatively time-consuming task, so this
411 key should only be active when analyzing the resident memory con‐
412 sumption of processes.
413 x Suppress colors to highlight critical resources (toggle).
415 Whether this key is active or not can be seen in the header line.
416 z The pause key can be used to freeze the current situation in order
418 to investigate the output on the screen. While atop is paused, the
419 keys described above can be pressed to show other information
420 about the current list of processes. Whenever the pause key is
421 pressed again, atop will continue with a next sample.
422 i Modify the interval timer (default: 10 seconds). If an interval
424 timer of 0 is entered, the interval timer is switched off. In that
425 case a new sample can only be triggered manually by pressing the
426 key 't'.
427 t Trigger a new sample manually. This key can be pressed if the cur‐
429 rent sample should be finished before the timer has exceeded, or
430 if no timer is set at all (interval timer defined as 0). In the
431 latter case atop can be used as a stopwatch to measure the load
432 being caused by a particular application transaction, without
433 knowing on beforehand how many seconds this transaction will last.
434 When viewing the contents of a raw file, this key can be used to
436 show the next sample from the file.
437 T When viewing the contents of a raw file, this key can be used to
439 show the previous sample from the file.
440 b When viewing the contents of a raw file, this key can be used to
442 branch to a certain timestamp within the file (either forward or
443 backward).
444 r Reset all counters to zero to see the system and process activity
446 since boot again.
447 When viewing the contents of a raw file, this key can be used to
449 rewind to the beginning of the file again.
450 U Specify a search string for specific user names as a regular
452 expression. From now on, only (active) processes will be shown
453 from a user which matches the regular expression. The system sta‐
454 tistics are still system wide. If the Enter-key is pressed with‐
455 out specifying a name, (active) processes of all users will be
456 shown again.
457 Whether this key is active or not can be seen in the header line.
458 I Specify a list with one or more PIDs to be selected. From now on,
460 only processes will be shown with a PID which matches one of the
461 given list. The system statistics are still system wide. If the
462 Enter-key is pressed without specifying a PID, all (active) pro‐
463 cesses will be shown again.
464 Whether this key is active or not can be seen in the header line.
465 P Specify a search string for specific process names as a regular
467 expression. From now on, only processes will be shown with a name
468 which matches the regular expression. The system statistics are
469 still system wide. If the Enter-key is pressed without specifying
470 a name, all (active) processes will be shown again.
471 Whether this key is active or not can be seen in the header line.
472 / Specify a specific command line search string as a regular expres‐
474 sion. From now on, only processes will be shown with a command
475 line which matches the regular expression. The system statistics
476 are still system wide. If the Enter-key is pressed without speci‐
477 fying a string, all (active) processes will be shown again.
478 Whether this key is active or not can be seen in the header line.
479 J Specify a Docker container id of 12 (hexadecimal) characters.
481 From now on, only processes will be shown that run in that spe‐
482 cific Docker container (CID). The system statistics are still
483 system wide. If the Enter-key is pressed without specifying a
484 container id, all (active) processes will be shown again.
485 Whether this key is active or not can be seen in the header line.
486 S Specify search strings for specific logical volume names, specific
488 disk names and specific network interface names. All search
489 strings are interpreted as a regular expressions. From now on,
490 only those system resources are shown that match the concerning
491 regular expression. If the Enter-key is pressed without specify‐
492 ing a search string, all (active) system resources of that type
493 will be shown again.
494 Whether this key is active or not can be seen in the header line.
495 a The `all/active' key can be used to toggle between only show‐
497 ing/accumulating the processes that were active during the last
498 interval (default) or showing/accumulating all processes.
499 Whether this key is active or not can be seen in the header line.
500 G By default, atop shows/accumulates the processes that are alive
502 and the processes that are exited during the last interval. With
503 this key (toggle), showing/accumulating the processes that are
504 exited can be suppressed.
505 Whether this key is active or not can be seen in the header line.
506 f Show a fixed (maximum) number of header lines for system resources
508 (toggle). By default only the lines are shown about system
509 resources (CPUs, paging, logical volumes, disks, network inter‐
510 faces) that really have been active during the last interval.
511 With this key you can force atop to show lines of inactive
512 resources as well.
513 Whether this key is active or not can be seen in the header line.
514 F Suppress sorting of system resources (toggle). By default system
516 resources (CPUs, logical volumes, disks, network interfaces) are
517 sorted on utilization.
518 Whether this key is active or not can be seen in the header line.
519 1 Show relevant counters as an average per second (in the format
521 `..../s') instead of as a total during the interval (toggle).
522 Whether this key is active or not can be seen in the header line.
523 l Limit the number of system level lines for the counters per-cpu,
525 the active disks and the network interfaces. By default lines are
526 shown of all CPUs, disks and network interfaces which have been
527 active during the last interval. Limiting these lines can be use‐
528 ful on systems with huge number CPUs, disks or interfaces in order
529 to be able to run atop on a screen/window with e.g. only 24 lines.
530 For all mentioned resources the maximum number of lines can be
531 specified interactively. When using the flag -l the maximum number
532 of per-cpu lines is set to 0, the maximum number of disk lines to
533 5 and the maximum number of interface lines to 3. These values
534 can be modified again in interactive mode.
535 k Send a signal to an active process (a.k.a. kill a process).
537 q Quit the program.
539 PgDn Show the next page of the process/thread list.
541 With the arrow-down key the list can be scrolled downwards with
542 single lines.
543 ^F Show the next page of the process/thread list (forward).
545 With the arrow-down key the list can be scrolled downwards with
546 single lines.
547 PgUp Show the previous page of the process/thread list.
549 With the arrow-up key the list can be scrolled upwards with single
550 lines.
551 ^B Show the previous page of the process/thread list (backward).
553 With the arrow-up key the list can be scrolled upwards with single
554 lines.
555 ^L Redraw the screen.
557
559 In order to store system and process level statistics for long-term
560 analysis (e.g. to check the system load and the active processes run‐
561 ning yesterday between 3:00 and 4:00 PM), atop can store the system and
562 process level statistics in compressed binary format in a raw file with
563 the flag -w followed by the filename. If this file already exists and
564 is recognized as a raw data file, atop will append new samples to the
565 file (starting with a sample which reflects the activity since boot);
566 if the file does not exist, it will be created.
567 All processes/threads are stored in the raw file.
568 The interval (default: 10 seconds) and number of samples (default:
569 infinite) can be passed as last arguments. Instead of the number of
570 samples, the flag -S can be used to indicate that atop should finish
571 anyhow before midnight.
572 A raw file can be read and visualized again with the flag -r followed
574 by the filename. If no filename is specified, the file
575 /var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are
576 digits representing the current date). If a filename is specified in
577 the format YYYYMMDD (representing any valid date), the file
578 /var/log/atop/atop_YYYYMMDD is opened. If a filename with the symbolic
579 name y is specified, yesterday's daily logfile is opened (this can be
580 repeated so 'yyyy' indicates the logfile of four days ago).
581 The samples from the file can be viewed interactively by using the key
582 't' to show the next sample, the key 'T' to show the previous sample,
583 the key 'b' to branch to a particular time or the key 'r' to rewind to
584 the begin of the file.
585 When output is redirected to a file or pipe, atop prints all samples in
586 plain ASCII. The default line length is 80 characters in that case;
587 with the flag -L followed by an alternate line length, more (or less)
588 columns will be shown.
589 With the flag -b (begin time) and/or -e (end time) followed by a time
590 argument of the form HH:MM, a certain time period within the raw file
591 can be selected.
592 When atop is installed, the script atop.daily is stored in the
594 /usr/share/atop directory. This scripts takes care that atop is acti‐
595 vated every day at midnight to write compressed binary data to the file
596 /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes.
597 Furthermore the script removes all raw files which are older than four
598 weeks.
599 The script is activated via the cron daemon using the file
600 /etc/cron.d/atop with the contents
601 0 0 * * * root /usr/share/atop/atop.daily
602 When the package psacct is installed, the process accounting is auto‐
604 matically restarted via the logrotate mechanism. The file /etc/logro‐
605 tate.d/psaccs_atop takes care that atop is finished just before the
606 rotation of the process accounting file and the file /etc/logro‐
607 tate.d/psaccu_atop takes care that atop is restarted again after the
608 rotation. When the package psacct is not installed, these logrotate-
609 files have no effect.
610
612 The first sample shows the system level activity since boot (the
613 elapsed time in the header shows the time since boot). Note that par‐
614 ticular counters could have reached their maximum value (several times)
615 and started by zero again, so do not rely on these figures.
616 For every sample atop first shows the lines related to system level
618 activity. If a particular system resource has not been used during the
619 interval, the entire line related to this resource is suppressed. So
620 the number of system level lines may vary for each sample.
621 After that a list is shown of processes which have been active during
622 the last interval. This list is by default sorted on cpu consumption,
623 but this order can be changed by the keys which are previously
624 described.
625 If values have to be shown by atop which do not fit in the column
627 width, another format is used. If e.g. a cpu-consumption of 233216 mil‐
628 liseconds should be shown in a column width of 4 positions, it is shown
629 as `233s' (in seconds). For large memory figures, another unit is cho‐
630 sen if the value does not fit (Mb instead of Kb, Gb instead of Mb, Tb
631 instead of Gb, ...). For other values, a kind of exponent notation is
632 used (value 123456789 shown in a column of 5 positions gives 123e6).
633
635 The system level information consists of the following output lines:
636 PRC Process and thread level totals.
638 This line contains the total cpu time consumed in system mode
639 (`sys') and in user mode (`user'), the total number of processes
640 present at this moment (`#proc'), the total number of threads
641 present at this moment in state `running' (`#trun'), `sleeping
642 interruptible' (`#tslpi') and `sleeping uninterruptible'
643 (`#tslpu'), the number of zombie processes (`#zombie'), the number
644 of clone system calls (`clones'), and the number of processes that
645 ended during the interval (`#exit') when process accounting is
646 used. Instead of `#exit` the last column may indicate that process
647 accounting could not be activated (`no procacct`).
648 If the screen-width does not allow all of these counters, only a
649 relevant subset is shown.
650 CPU CPU utilization.
652 At least one line is shown for the total occupation of all CPUs
653 together.
654 In case of a multi-processor system, an additional line is shown
655 for every individual processor (with `cpu' in lower case), sorted
656 on activity. Inactive CPUs will not be shown by default. The
657 lines showing the per-cpu occupation contain the cpu number in the
658 last field.
659 Every line contains the percentage of cpu time spent in kernel
661 mode by all active processes (`sys'), the percentage of cpu time
662 consumed in user mode (`user') for all active processes (including
663 processes running with a nice value larger than zero), the per‐
664 centage of cpu time spent for interrupt handling (`irq') including
665 softirq, the percentage of unused cpu time while no processes were
666 waiting for disk-I/O (`idle'), and the percentage of unused cpu
667 time while at least one process was waiting for disk-I/O (`wait').
668 In case of per-cpu occupation, the last column shows the cpu num‐
669 ber and the wait percentage (`w') for that cpu. The number of
670 lines showing the per-cpu occupation can be limited.
671 For virtual machines the steal-percentage is shown (`steal'),
673 reflecting the percentage of cpu time stolen by other virtual
674 machines running on the same hardware.
675 For physical machines hosting one or more virtual machines, the
676 guest-percentage is shown (`guest'), reflecting the percentage of
677 cpu time used by the virtual machines. Notice that this percentage
678 overlaps the user-percentage.
679 In case of frequency-scaling, all previously mentioned CPU-per‐
681 centages are relative to the used scaling of the CPU during the
682 interval. If a CPU has been active for e.g. 50% in user mode dur‐
683 ing the interval while the frequency-scaling of that CPU was 40%,
684 only 20% of the full capacity of the CPU has been used in user
685 mode.
686 In case that the kernel module `cpufreq_stats' is active (after
687 issueing `modprobe cpufreq_stats'), the average frequency (`avgf')
688 and the average scaling percentage (`avgscal') is shown. Otherwise
689 the current frequency (`curf') and the current scaling percentage
690 (`curscal') is shown at the moment that the sample is taken.
691 If the screen-width does not allow all of these counters, only a
693 relevant subset is shown.
694 CPL CPU load information.
696 This line contains the load average figures reflecting the number
697 of threads that are available to run on a CPU (i.e. part of the
698 runqueue) or that are waiting for disk I/O. These figures are
699 averaged over 1 (`avg1'), 5 (`avg5') and 15 (`avg15') minutes.
700 Furthermore the number of context switches (`csw'), the number of
701 serviced interrupts (`intr') and the number of available CPUs are
702 shown.
703 If the screen-width does not allow all of these counters, only a
705 relevant subset is shown.
706 MEM Memory occupation.
708 This line contains the total amount of physical memory (`tot'),
709 the amount of memory which is currently free (`free'), the amount
710 of memory in use as page cache including the total resident shared
711 memory (`cache'), the amount of memory within the page cache that
712 has to be flushed to disk (`dirty'), the amount of memory used for
713 filesystem meta data (`buff'), the amount of memory being used for
714 kernel mallocs (`slab'), the amount of slab memory that is
715 reclaimable (`slrec'), the resident size of shared memory includ‐
716 ing tmpfs (`shmem`), the resident size of shared memory (`shrss`)
717 the amount of shared memory that is currently swapped (`shswp`),
718 the amount of memory that is currently claimed by vmware's balloon
719 driver (`vmbal`), the amount of memory that is claimed for huge
720 pages (`hptot`), and the amount of huge page memory that is really
721 in use (`hpuse`).
722 If the screen-width does not allow all of these counters, only a
724 relevant subset is shown.
725 SWP Swap occupation and overcommit info.
727 This line contains the total amount of swap space on disk (`tot')
728 and the amount of free swap space (`free').
729 Furthermore the committed virtual memory space (`vmcom') and the
730 maximum limit of the committed space (`vmlim', which is by default
731 swap size plus 50% of memory size) is shown. The committed space
732 is the reserved virtual space for all allocations of private mem‐
733 ory space for processes. The kernel only verifies whether the com‐
734 mitted space exceeds the limit if strict overcommit handling is
735 configured (vm.overcommit_memory is 2).
736 PAG Paging frequency.
738 This line contains the number of scanned pages (`scan') due to the
739 fact that free memory drops below a particular threshold and the
740 number times that the kernel tries to reclaim pages due to an
741 urgent need (`stall').
742 Also the number of memory pages the system read from swap space
743 (`swin') and the number of memory pages the system wrote to swap
744 space (`swout') are shown.
745 LVM/MDD/DSK
747 Logical volume/multiple device/disk utilization.
748 Per active unit one line is produced, sorted on unit activity.
749 Such line shows the name (e.g. VolGroup00-lvtmp for a logical vol‐
750 ume or sda for a hard disk), the busy percentage i.e. the portion
751 of time that the unit was busy handling requests (`busy'), the
752 number of read requests issued (`read'), the number of write
753 requests issued (`write'), the number of KiBytes per read
754 (`KiB/r'), the number of KiBytes per write (`KiB/w'), the number
755 of MiBytes per second throughput for reads (`MBr/s'), the number
756 of MiBytes per second throughput for writes (`MBw/s'), the average
757 queue depth (`avq') and the average number of milliseconds needed
758 by a request (`avio') for seek, latency and data transfer.
759 If the screen-width does not allow all of these counters, only a
760 relevant subset is shown.
761 The number of lines showing the units can be limited per class
763 (LVM, MDD or DSK) with the 'l' key or statically (see separate
764 man-page of atoprc). By specifying the value 0 for a particular
765 class, no lines will be shown any more for that class.
766 NFM Network Filesystem (NFS) mount at the client side.
768 For each NFS-mounted filesystem, a line is shown that contains the
769 mounted server directory, the name of the server (`srv'), the
770 total number of bytes physically read from the server (`read') and
771 the total number of bytes physically written to the server
772 (`write'). Data transfer is subdivided in the number of bytes
773 read via normal read() system calls (`nread'), the number of bytes
774 written via normal read() system calls (`nwrit'), the number of
775 bytes read via direct I/O (`dread'), the number of bytes written
776 via direct I/O (`dwrit'), the number of bytes read via memory
777 mapped I/O pages (`mread'), and the number of bytes written via
778 memory mapped I/O pages (`mwrit').
779 NFC Network Filesystem (NFS) client side counters.
781 This line contains the number of RPC calls issues by local pro‐
782 cesses (`rpc'), the number of read RPC calls (`read`) and write
783 RPC calls (`rpwrite') issued to the NFS server, the number of RPC
784 calls being retransmitted (`retxmit') and the number of authoriza‐
785 tion refreshes (`autref').
786 NFS Network Filesystem (NFS) server side counters.
788 This line contains the number of RPC calls received from NFS
789 clients (`rpc'), the number of read RPC calls received (`cread`),
790 the number of write RPC calls received (`cwrit'), the number of
791 network requests handled via TCP (`nettcp'), the number of network
792 requests handled via UDP (`netudp'), the number of Megabytes/sec‐
793 ond returned to read requests by clients (`MBcr/s`), the number of
794 Megabytes/second passed in write requests by clients (`MBcw/s`),
795 the number of reply cache hits (`rchits'), the number of reply
796 cache misses (`rcmiss') and the number of uncached requests
797 (`rcnoca'). Furthermore some error counters indicating the number
798 of requests with a bad format (`badfmt') or a bad authorization
799 (`badaut'), and a counter indicating the number of bad clients
800 (`badcln'). and the number of authorization refreshes (`autref').
801 NET Network utilization (TCP/IP).
803 One line is shown for activity of the transport layer (TCP and
804 UDP), one line for the IP layer and one line per active interface.
805 For the transport layer, counters are shown concerning the number
806 of received TCP segments including those received in error
807 (`tcpi'), the number of transmitted TCP segments excluding those
808 containing only retransmitted octets (`tcpo'), the number of UDP
809 datagrams received (`udpi'), the number of UDP datagrams transmit‐
810 ted (`udpo'), the number of active TCP opens (`tcpao'), the number
811 of passive TCP opens (`tcppo'), the number of TCP output retrans‐
812 missions (`tcprs'), the number of TCP input errors (`tcpie'), the
813 number of TCP output resets (`tcpor'), the number of UDP no ports
814 (`udpnp'), and the number of UDP input errors (`udpie').
815 If the screen-width does not allow all of these counters, only a
816 relevant subset is shown.
817 These counters are related to IPv4 and IPv6 combined.
818 For the IP layer, counters are shown concerning the number of IP
820 datagrams received from interfaces, including those received in
821 error (`ipi'), the number of IP datagrams that local higher-layer
822 protocols offered for transmission (`ipo'), the number of received
823 IP datagrams which were forwarded to other interfaces (`ipfrw'),
824 the number of IP datagrams which were delivered to local higher-
825 layer protocols (`deliv'), the number of received ICMP datagrams
826 (`icmpi'), and the number of transmitted ICMP datagrams (`icmpo').
827 If the screen-width does not allow all of these counters, only a
828 relevant subset is shown.
829 These counters are related to IPv4 and IPv6 combined.
830 For every active network interface one line is shown, sorted on
832 the interface activity. Such line shows the name of the interface
833 and its busy percentage in the first column. The busy percentage
834 for half duplex is determined by comparing the interface speed
835 with the number of bits transmitted and received per second; for
836 full duplex the interface speed is compared with the highest of
837 either the transmitted or the received bits. When the interface
838 speed can not be determined (e.g. for the loopback interface),
839 `---' is shown instead of the percentage.
840 Furthermore the number of received packets (`pcki'), the number of
841 transmitted packets (`pcko'), the line speed of the interface
842 (`sp'), the effective amount of bits received per second (`si'),
843 the effective amount of bits transmitted per second (`so'), the
844 number of collisions (`coll'), the number of received multicast
845 packets (`mlti'), the number of errors while receiving a packet
846 (`erri'), the number of errors while transmitting a packet
847 (`erro'), the number of received packets dropped (`drpi'), and the
848 number of transmitted packets dropped (`drpo').
849 If the screen-width does not allow all of these counters, only a
850 relevant subset is shown.
851 The number of lines showing the network interfaces can be limited.
852
854 Following the system level information, the processes are shown from
855 which the resource utilization has changed during the last interval.
856 These processes might have used cpu time or issued disk or network
857 requests. However a process is also shown if part of it has been paged
858 out due to lack of memory (while the process itself was in sleep
859 state).
860 Per process the following fields may be shown (in alphabetical order),
862 depending on the current output mode as described in the section INTER‐
863 ACTIVE COMMANDS and depending on the current width of your window:
864 AVGRSZ The average size of one read-action on disk.
866 AVGWSZ The average size of one write-action on disk.
868 BANDWI Total bandwidth for received TCP and UDP packets consumed by
870 this process (bits-per-second). This value can be compared
871 with the value `si' on interface level (used bandwidth per
872 interface).
873 This information will only be shown when the kernel module
874 `netatop' is loaded.
875 BANDWO Total bandwidth for sent TCP and UDP packets consumed by this
877 process (bits-per-second). This value can be compared with
878 the value `so' on interface level (used bandwidth per inter‐
879 face).
880 This information will only be shown when the kernel module
881 `netatop' is loaded.
882 CID Container ID (Docker) of 12 hexadecimal digits, referring to
884 the container in which the process/thread is running. If a
885 process has been started and finished during the last inter‐
886 val, a `?' is shown because the container ID is not part of
887 the standard process accounting record.
888 CMD The name of the process. This name can be surrounded by
890 "less/greater than" signs (`<name>') which means that the
891 process has finished during the last interval.
892 Behind the abbreviation `CMD' in the header line, the current
893 page number and the total number of pages of the
894 process/thread list are shown.
895 COMMAND-LINE
897 The full command line of the process (including arguments). If
898 the length of the command line exceeds the length of the
899 screen line, the arrow keys -> and <- can be used for horizon‐
900 tal scroll.
901 Behind the verb `COMMAND-LINE' in the header line, the current
902 page number and the total number of pages of the
903 process/thread list are shown.
904 CPU The occupation percentage of this process related to the
906 available capacity for this resource on system level.
907 CPUNR The identification of the CPU the (main) thread is running on
909 or has recently been running on.
910 CTID Container ID (OpenVZ). If a process has been started and fin‐
912 ished during the last interval, a `?' is shown because the
913 container ID is not part of the standard process accounting
914 record.
915 DSK The occupation percentage of this process related to the total
917 load that is produced by all processes (i.e. total disk
918 accesses by all processes during the last interval).
919 This information is shown when per process "storage account‐
920 ing" is active in the kernel.
921 EGID Effective group-id under which this process executes.
923 ENDATE Date that the process has been finished. If the process is
925 still running, this field shows `active'.
926 ENTIME Time that the process has been finished. If the process is
928 still running, this field shows `active'.
929 ENVID Virtual environment identified (OpenVZ only).
931 EUID Effective user-id under which this process executes.
933 EXC The exit code of a terminated process (second position of col‐
935 umn `ST' is E) or the fatal signal number (second position of
936 column `ST' is S or C).
937 FSGID Filesystem group-id under which this process executes.
939 FSUID Filesystem user-id under which this process executes.
941 MAJFLT The number of page faults issued by this process that have
943 been solved by creating/loading the requested memory page.
944 MEM The occupation percentage of this process related to the
946 available capacity for this resource on system level.
947 MINFLT The number of page faults issued by this process that have
949 been solved by reclaiming the requested memory page from the
950 free list of pages.
951 NET The occupation percentage of this process related to the total
953 load that is produced by all processes (i.e. consumed network
954 bandwidth of all processes during the last interval).
955 This information will only be shown when kernel module
956 `netatop' is loaded.
957 NICE The more or less static priority that can be given to a
959 process on a scale from -20 (high priority) to +19 (low prior‐
960 ity).
961 NPROCS The number of active and terminated processes accumulated for
963 this user or program.
964 PID Process-id. If a process has been started and finished during
966 the last interval, a `?' is shown because the process-id is
967 not part of the standard process accounting record.
968 POLI The policies 'norm' (normal, which is SCHED_OTHER), 'btch'
970 (batch) and 'idle' refer to timesharing processes. The poli‐
971 cies 'fifo' (SCHED_FIFO) and 'rr' (round robin, which is
972 SCHED_RR) refer to realtime processes.
973 PPID Parent process-id. If a process has been started and finished
975 during the last interval, value 0 is shown because the parent
976 process-id is not part of the standard process accounting
977 record.
978 PRI The process' priority ranges from 0 (highest priority) to 139
980 (lowest priority). Priority 0 to 99 are used for realtime pro‐
981 cesses (fixed priority independent of their behavior) and pri‐
982 ority 100 to 139 for timesharing processes (variable priority
983 depending on their recent CPU consumption and the nice value).
984 PSIZE The proportional memory size of this process (or user).
986 Every process shares resident memory with other processes.
987 E.g. when a particular program is started several times, the
988 code pages (text) are only loaded once in memory and shared by
989 all incarnations. Also the code of shared libraries is shared
990 by all processes using that shared library, as well as shared
991 memory and memory-mapped files. For the PSIZE calculation of
992 a process, the resident memory of a process that is shared
993 with other processes is divided by the number of sharers.
994 This means, that every process is accounted for a proportional
995 part of that memory. Accumulating the PSIZE values of all pro‐
996 cesses in the system gives a reliable impression of the total
997 resident memory consumed by all processes.
998 Since gathering of all values that are needed to calculate the
999 PSIZE is a relatively time-consuming task, the 'R' key (or
1000 '-R' flag) should be active. Gathering these values also
1001 requires superuser privileges (otherwise '?K' is shown in the
1002 output).
1003 If a process has finished during the last interval, no value
1004 is shown since the proportional memory size is not part of the
1005 standard process accounting record.
1006 RDDSK When the kernel maintains standard io statistics (>= 2.6.20):
1008 The read data transfer issued physically on disk (so reading
1009 from the disk cache is not accounted for).
1010 Unfortunately, the kernel aggregates the data tranfer of a
1011 process to the data transfer of its parent process when termi‐
1012 nating, so you might see transfers for (parent) processes like
1013 cron, bash or init, that are not really issued by them.
1014 RGID The real group-id under which the process executes.
1016 RGROW The amount of resident memory that the process has grown dur‐
1018 ing the last interval. A resident growth can be caused by
1019 touching memory pages which were not physically created/loaded
1020 before (load-on-demand). Note that a resident growth can also
1021 be negative e.g. when part of the process is paged out due to
1022 lack of memory or when the process frees dynamically allocated
1023 memory. For a process which started during the last interval,
1024 the resident growth reflects the total resident size of the
1025 process at that moment.
1026 If a process has finished during the last interval, no value
1027 is shown since resident memory occupation is not part of the
1028 standard process accounting record.
1029 RNET The number of TCP- and UDP packets received by this process.
1031 This information will only be shown when kernel module
1032 `netatop' is installed.
1033 If a process has finished during the last interval, no value
1034 is shown since network counters are not part of the standard
1035 process accounting record.
1036 RSIZE The total resident memory usage consumed by this process (or
1038 user). Notice that the RSIZE of a process includes all resi‐
1039 dent memory used by that process, even if certain memory parts
1040 are shared with other processes (see also the explanation of
1041 PSIZE).
1042 If a process has finished during the last interval, no value
1043 is shown since resident memory occupation is not part of the
1044 standard process accounting record.
1045 RTPR Realtime priority according the POSIX standard. Value can be
1047 0 for a timesharing process (policy 'norm', 'btch' or 'idle')
1048 or ranges from 1 (lowest) till 99 (highest) for a realtime
1049 process (policy 'rr' or 'fifo').
1050 RUID The real user-id under which the process executes.
1052 S The current state of the (main) thread: `R' for running (cur‐
1054 rently processing or in the runqueue), `S' for sleeping inter‐
1055 ruptible (wait for an event to occur), `D' for sleeping non-
1056 interruptible, `Z' for zombie (waiting to be synchronized with
1057 its parent process), `T' for stopped (suspended or traced),
1058 `W' for swapping, and `E' (exit) for processes which have fin‐
1059 ished during the last interval.
1060 SGID The saved group-id of the process.
1062 SNET The number of TCP and UDP packets transmitted by this process.
1064 This information will only be shown when the kernel module
1065 `netatop' is loaded.
1066 ST The status of a process.
1068 The first position indicates if the process has been started
1069 during the last interval (the value N means 'new process').
1070 The second position indicates if the process has been finished
1072 during the last interval.
1073 The value E means 'exit' on the process' own initiative; the
1074 exit code is displayed in the column `EXC'.
1075 The value S means that the process has been terminated unvol‐
1076 untarily by a signal; the signal number is displayed in the in
1077 the column `EXC'.
1078 The value C means that the process has been terminated unvol‐
1079 untarily by a signal, producing a core dump in its current
1080 directory; the signal number is displayed in the column `EXC'.
1081 STDATE The start date of the process.
1083 STTIME The start time of the process.
1085 SUID The saved user-id of the process.
1087 SWAPSZ The swap space consumed by this process (or user).
1089 SYSCPU CPU time consumption of this process in system mode (kernel
1091 mode), usually due to system call handling.
1092 TCPRASZ The average size of a received TCP buffer in bytes. This
1094 information will only be shown when the kernel module
1095 `netatop' is loaded.
1096 TCPRCV The number of TCP packets received for this process. This
1098 information will only be shown when the kernel module
1099 `netatop' is loaded.
1100 TCPSASZ The average size of a transmitted TCP buffer in bytes. This
1102 information will only be shown when the kernel module
1103 `netatop' is loaded.
1104 TCPSND The number of TCP packets transmitted for this process. This
1106 information will only be shown when the kernel module
1107 `netatop' is loaded.
1108 THR Total number of threads within this process. All related
1110 threads are contained in a thread group, represented by atop
1111 as one line or as a separate line when the 'y' key (or -y
1112 flag) is active.
1113 On Linux 2.4 systems it is hardly possible to determine which
1115 threads (i.e. processes) are related to the same thread group.
1116 Every thread is represented by atop as a separate line.
1117 TID Thread-id. All threads within a process run with the same PID
1119 but with a different TID. This value is shown for individual
1120 threads in multi-threaded processes (when using the key 'y').
1121 TRUN Number of threads within this process that are in the state
1123 'running' (R).
1124 TSLPI Number of threads within this process that are in the state
1126 'interruptible sleeping' (S).
1127 TSLPU Number of threads within this process that are in the state
1129 'uninterruptible sleeping' (D).
1130 UDPRASZ The average size of a received UDP packet in bytes. This
1132 information will only be shown when the kernel module
1133 `netatop' is loaded.
1134 UDPRCV The number of UDP packets received by this process. This
1136 information will only be shown when the kernel module
1137 `netatop' is loaded.
1138 UDPSASZ The average size of a transmitted UDP packets in bytes. This
1140 information will only be shown when the kernel module
1141 `netatop' is loaded.
1142 UDPSND The number of UDP packets transmitted by this process. This
1144 information will only be shown when the kernel module
1145 `netatop' is loaded.
1146 USRCPU CPU time consumption of this process in user mode, due to pro‐
1148 cessing the own program text.
1149 VDATA The virtual memory size of the private data used by this
1151 process (including heap and shared library data).
1152 VGROW The amount of virtual memory that the process has grown during
1154 the last interval. A virtual growth can be caused by e.g.
1155 issueing a malloc() or attaching a shared memory segment. Note
1156 that a virtual growth can also be negative by e.g. issueing a
1157 free() or detaching a shared memory segment. For a process
1158 which started during the last interval, the virtual growth
1159 reflects the total virtual size of the process at that moment.
1160 If a process has finished during the last interval, no value
1161 is shown since virtual memory occupation is not part of the
1162 standard process accounting record.
1163 VPID Virtual process-id (within an OpenVZ container). If a process
1165 has been started and finished during the last interval, a `?'
1166 is shown because the virtual process-id is not part of the
1167 standard process accounting record.
1168 VSIZE The total virtual memory usage consumed by this process (or
1170 user).
1171 If a process has finished during the last interval, no value
1172 is shown since virtual memory occupation is not part of the
1173 standard process accounting record.
1174 VSLIBS The virtual memory size of the (shared) text of all shared
1176 libraries used by this process.
1177 VSTACK The virtual memory size of the (private) stack used by this
1179 process
1180 VSTEXT The virtual memory size of the (shared) text of the executable
1182 program.
1183 WRDSK When the kernel maintains standard io statistics (>= 2.6.20):
1185 The write data transfer issued physically on disk (so writing
1186 to the disk cache is not accounted for). This counter is
1187 maintained for the application process that writes its data to
1188 the cache (assuming that this data is physically transferred
1189 to disk later on). Notice that disk I/O needed for swapping is
1190 not taken into account.
1191 Unfortunately, the kernel aggregates the data tranfer of a
1192 process to the data transfer of its parent process when termi‐
1193 nating, so you might see transfers for (parent) processes like
1194 cron, bash or init, that are not really issued by them.
1195 WCANCL When the kernel maintains standard io statistics (>= 2.6.20):
1197 The write data transfer previously accounted for this process
1198 or another process that has been cancelled. Suppose that a
1199 process writes new data to a file and that data is removed
1200 again before the cache buffers have been flushed to disk.
1201 Then the original process shows the written data as WRDSK,
1202 while the process that removes/truncates the file shows the
1203 unflushed removed data as WCANCL.
1204
1206 With the flag -P followed by a list of one or more labels (comma-sepa‐
1207 rated), parseable output is produced for each sample. The labels that
1208 can be specified for system-level statistics correspond to the labels
1209 (first verb of each line) that can be found in the interactive output:
1210 "CPU", "cpu" "CPL" "MEM", "SWP", "PAG", "LVM", "MDD", "DSK", "NFM",
1211 "NFC", "NFS" and "NET".
1212 For process-level statistics special labels are introduced: "PRG" (gen‐
1213 eral), "PRC" (cpu), "PRM" (memory), "PRD" (disk, only if "storage
1214 accounting" is active) and "PRN" (network, only if the kernel module
1215 'netatop' has been installed).
1216 With the label "ALL", all system and process level statistics are
1217 shown.
1218 For every interval all requested lines are shown whereafter atop shows
1220 a line just containing the label "SEP" as a separator before the lines
1221 for the next sample are generated.
1222 When a sample contains the values since boot, atop shows a line just
1223 containing the label "RESET" before the lines for this sample are gen‐
1224 erated.
1225 The first part of each output-line consists of the following six
1227 fields: label (the name of the label), host (the name of this machine),
1228 epoch (the time of this interval as number of seconds since 1-1-1970),
1229 date (date of this interval in format YYYY/MM/DD), time (time of this
1230 interval in format HH:MM:SS), and interval (number of seconds elapsed
1231 for this interval).
1232 The subsequent fields of each output-line depend on the label:
1234 CPU Subsequent fields: total number of clock-ticks per second for
1236 this machine, number of processors, consumption for all CPUs
1237 in system mode (clock-ticks), consumption for all CPUs in user
1238 mode (clock-ticks), consumption for all CPUs in user mode for
1239 niced processes (clock-ticks), consumption for all CPUs in
1240 idle mode (clock-ticks), consumption for all CPUs in wait mode
1241 (clock-ticks), consumption for all CPUs in irq mode (clock-
1242 ticks), consumption for all CPUs in softirq mode (clock-
1243 ticks), consumption for all CPUs in steal mode (clock-ticks),
1244 consumption for all CPUs in guest mode (clock-ticks) overlap‐
1245 ping user mode, frequency of all CPUs and frequency percentage
1246 of all CPUs.
1247 cpu Subsequent fields: total number of clock-ticks per second for
1249 this machine, processor-number, consumption for this CPU in
1250 system mode (clock-ticks), consumption for this CPU in user
1251 mode (clock-ticks), consumption for this CPU in user mode for
1252 niced processes (clock-ticks), consumption for this CPU in
1253 idle mode (clock-ticks), consumption for this CPU in wait mode
1254 (clock-ticks), consumption for this CPU in irq mode (clock-
1255 ticks), consumption for this CPU in softirq mode (clock-
1256 ticks), consumption for this CPU in steal mode (clock-ticks),
1257 consumption for this CPU in guest mode (clock-ticks) overlap‐
1258 ping user mode, frequency of this CPU and frequency percentage
1259 of this CPU.
1260 CPL Subsequent fields: number of processors, load average for last
1262 minute, load average for last five minutes, load average for
1263 last fifteen minutes, number of context-switches, and number
1264 of device interrupts.
1265 MEM Subsequent fields: page size for this machine (in bytes), size
1267 of physical memory (pages), size of free memory (pages), size
1268 of page cache (pages), size of buffer cache (pages), size of
1269 slab (pages), dirty pages in cache (pages), reclaimable part
1270 of slab (pages), total size of vmware's balloon pages (pages),
1271 total size of shared memory (pages), size of resident shared
1272 memory (pages), size of swapped shared memory (pages), huge
1273 page size (in bytes), total size of huge pages (huge pages),
1274 and size of free huge pages (huge pages).
1275 SWP Subsequent fields: page size for this machine (in bytes), size
1277 of swap (pages), size of free swap (pages), 0 (future use),
1278 size of committed space (pages), and limit for committed space
1279 (pages).
1280 PAG Subsequent fields: page size for this machine (in bytes), num‐
1282 ber of page scans, number of allocstalls, 0 (future use), num‐
1283 ber of swapins, and number of swapouts.
1284 LVM/MDD/DSK
1286 For every logical volume/multiple device/hard disk one line is
1287 shown.
1288 Subsequent fields: name, number of milliseconds spent for I/O,
1289 number of reads issued, number of sectors transferred for
1290 reads, number of writes issued, and number of sectors trans‐
1291 ferred for write.
1292 NFM Subsequent fields: mounted NFS filesystem, total number of
1294 bytes read, total number of bytes written, number of bytes
1295 read by normal system calls, number of bytes written by normal
1296 system calls, number of bytes read by direct I/O, number of
1297 bytes written by direct I/O, number of pages read by memory-
1298 mapped I/O, and number of pages written by memory-mapped I/O.
1299 NFC Subsequent fields: number of transmitted RPCs, number of
1301 transmitted read RPCs, number of transmitted write RPCs, num‐
1302 ber of RPC retransmissions, and number of authorization
1303 refreshes.
1304 NFS Subsequent fields: number of handled RPCs, number of received
1306 read RPCs, number of received write RPCs, number of bytes read
1307 by clients, number of bytes written by clients, number of RPCs
1308 with bad format, number of RPCs with bad authorization, number
1309 of RPCs from bad client, total number of handled network
1310 requests, number of handled network requests via TCP, number
1311 of handled network requests via UDP, number of handled TCP
1312 connections, number of hits on reply cache, number of misses
1313 on reply cache, and number of uncached requests.
1314 NET First one line is produced for the upper layers of the TCP/IP
1316 stack.
1317 Subsequent fields: the verb "upper", number of packets
1318 received by TCP, number of packets transmitted by TCP, number
1319 of packets received by UDP, number of packets transmitted by
1320 UDP, number of packets received by IP, number of packets
1321 transmitted by IP, number of packets delivered to higher lay‐
1322 ers by IP, and number of packets forwarded by IP.
1323 Next one line is shown for every interface.
1325 Subsequent fields: name of the interface, number of packets
1326 received by the interface, number of bytes received by the
1327 interface, number of packets transmitted by the interface,
1328 number of bytes transmitted by the interface, interface speed,
1329 and duplex mode (0=half, 1=full).
1330 PRG For every process one line is shown.
1332 Subsequent fields: PID (unique ID of task), name (between
1333 brackets), state, real uid, real gid, TGID (group number of
1334 related tasks/threads), total number of threads, exit code,
1335 start time (epoch), full command line (between brackets),
1336 PPID, number of threads in state 'running' (R), number of
1337 threads in state 'interruptible sleeping' (S), number of
1338 threads in state 'uninterruptible sleeping' (D), effective
1339 uid, effective gid, saved uid, saved gid, filesystem uid,
1340 filesystem gid, elapsed time (hertz), is_process (y/n), OpenVZ
1341 virtual pid (VPID), OpenVZ container id (CTID) and Docker con‐
1342 tainer id (CID).
1343 PRC For every process one line is shown.
1345 Subsequent fields: PID, name (between brackets), state, total
1346 number of clock-ticks per second for this machine, CPU-con‐
1347 sumption in user mode (clockticks), CPU-consumption in system
1348 mode (clockticks), nice value, priority, realtime priority,
1349 scheduling policy, current CPU, sleep average, TGID (group
1350 number of related tasks/threads) and is_process (y/n).
1351 PRM For every process one line is shown.
1353 Subsequent fields: PID, name (between brackets), state, page
1354 size for this machine (in bytes), virtual memory size
1355 (Kbytes), resident memory size (Kbytes), shared text memory
1356 size (Kbytes), virtual memory growth (Kbytes), resident memory
1357 growth (Kbytes), number of minor page faults, number of major
1358 page faults, virtual library exec size (Kbytes), virtual data
1359 size (Kbytes), virtual stack size (Kbytes), swap space used
1360 (Kbytes), TGID (group number of related tasks/threads),
1361 is_process (y/n) and proportional set size (Kbytes) if in 'R'
1362 option is specified.
1363 PRD For every process one line is shown.
1365 Subsequent fields: PID, name (between brackets), state, obso‐
1366 leted kernel patch installed ('n'), standard io statistics
1367 used ('y' or 'n'), number of reads on disk, cumulative number
1368 of sectors read, number of writes on disk, cumulative number
1369 of sectors written, cancelled number of written sectors, TGID
1370 (group number of related tasks/threads) and is_process (y/n).
1371 If the standard I/O statistics (>= 2.6.20) are not used, the
1372 disk I/O counters per process are not relevant. The counters
1373 'number of reads on disk' and 'number of writes on disk' are
1374 obsoleted anyhow.
1375 PRN For every process one line is shown.
1377 Subsequent fields: PID, name (between brackets), state, kernel
1378 module 'netatop' loaded ('y' or 'n'), number of TCP-packets
1379 transmitted, cumulative size of TCP-packets transmitted, num‐
1380 ber of TCP-packets received, cumulative size of TCP-packets
1381 received, number of UDP-packets transmitted, cumulative size
1382 of UDP-packets transmitted, number of UDP-packets received,
1383 cumulative size of UDP-packets transmitted, number of raw
1384 packets transmitted (obsolete, always 0), number of raw pack‐
1385 ets received (obsolete, always 0), TGID (group number of
1386 related tasks/threads) and is_process (y/n).
1387 If the kernel module is not active, the network I/O counters
1388 per process are not relevant.
1389
1391 To monitor the current system load interactively with an interval of 5
1392 seconds:
1393 atop 5
1395 To monitor the system load and write it to a file (in plain ASCII) with
1397 an interval of one minute during half an hour with active processes
1398 sorted on memory consumption:
1399 atop -M 60 30 > /log/atop.mem
1401 Store information about the system and process activity in binary com‐
1403 pressed form to a file with an interval of ten minutes during an hour:
1404 atop -w /tmp/atop.raw 600 6
1406 View the contents of this file interactively:
1408 atop -r /tmp/atop.raw
1410 View the processor and disk utilization of this file in parseable for‐
1412 mat:
1413 atop -PCPU,DSK -r /tmp/atop.raw
1415 View the contents of today's standard logfile interactively:
1417 atop -r
1419 View the contents of the standard logfile of the day before yesterday
1421 interactively:
1422 atop -r yy
1424 View the contents of the standard logfile of 2014, June 7 from 02:00 PM
1426 onwards interactively:
1427 atop -r 20140607 -b 14:00
1429
1431 /var/run/pacct_shadow.d/
1432 Directory containing the process accounting shadow files that are
1433 used by atop when the atopacctd daemon is active.
1434 /var/cache/atop.d/atop.acct
1436 File in which the kernel writes the accounting records when atop
1437 itself has activated the process accounting mechanism.
1438 /etc/atoprc
1440 Configuration file containing system-wide default values. See
1441 related man-page.
1442 ~/.atoprc
1444 Configuration file containing personal default values. See
1445 related man-page.
1446 /var/log/atop/atop_YYYYMMDD
1448 Raw file, where YYYYMMDD are digits representing the current date.
1449 This name is used by the script atop.daily as default name for the
1450 output file, and by atop as default name for the input file when
1451 using the -r flag.
1452 All binary system and process level data in this file has been
1453 stored in compressed format.
1454 /var/run/netatop.log
1456 File that contains the netpertask structs containing the network
1457 counters of exited processes. These structs are written by the
1458 netatopd daemon and read by atop after reading the standard
1459 process accounting records.
1460
1462 atopsar(1), atoprc(5), atopacctd(8), netatop(4), netatopd(8), logro‐
1463 tate(8)
1464 http://www.atoptool.nl
1465
1467 Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
1468 JC van Winkel
1469Linux March 2017 ATOP(1)