1ATOP(1) General Commands Manual ATOP(1)
2
6 atop - Advanced System & Process Monitor
7
9 Interactive Usage:
10 atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-afFG1xR]
12 [-L linelen] [-Plabel[,label]... [-Z] [-Jlabel[,label]...] [ interval
13 [ samples ]]
14 Writing and reading raw logfiles:
16 atop -w rawfile [-a] [-S] [ interval [ samples ]]
18 atop -r [ rawfile ] [-b [YYYYMMDD]hhmm ] [-e [YYYYMMDD]hhmm ]
19 [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-fFG1xR] [-L
20 linelen] [-Plabel[,label]... [-Z] [-Jlabel[,label]...]
21
23 The program atop is an interactive monitor to view the load on a Linux
24 system. It shows the occupation of the most critical hardware re‐
25 sources (from a performance point of view) on system level, i.e. cpu,
26 memory, disk and network.
27 It also shows which processes are responsible for the indicated load
28 with respect to cpu and memory load on process level. Disk load is
29 shown per process if "storage accounting" is active in the kernel.
30 Network load is shown per process if the kernel module `netatop' has
31 been installed.
32 The initial screen shows if atop runs with restricted view (unprivi‐
34 leged) or unrestricted view (privileged). In case of restricted view
35 atop does not have the privileges (root identity or necessary capabili‐
36 ties) to retrieve all counter values on system level and on process
37 level.
38 Every interval (default: 10 seconds) information is shown about the re‐
40 source occupation on system level (cpu, memory, disks and network lay‐
41 ers), followed by a list of processes which have been active during the
42 last interval (note that all processes that were unchanged during the
43 last interval are not shown, unless the key 'a' has been pressed or un‐
44 less sorting on memory occupation is done). If the list of active pro‐
45 cesses does not entirely fit on the screen, only the top of the list is
46 shown (sorted in order of activity).
47 The intervals are repeated till the number of samples (specified as
48 command argument) is reached, or till the key 'q' is pressed in inter‐
49 active mode.
50 When atop is started, it checks whether the standard output channel is
52 connected to a screen, or to a file/pipe. In the first case it produces
53 screen control codes (via the ncurses library) and behaves interac‐
54 tively; in the second case it produces flat ASCII-output.
55 In interactive mode, the output of atop scales dynamically to the cur‐
57 rent dimensions of the screen/window.
58 If the window is resized horizontally, columns will be added or removed
59 automatically. For this purpose, every column has a particular weight.
60 The columns with the highest weights that fit within the current width
61 will be shown.
62 If the window is resized vertically, lines of the process/thread list
63 will be added or removed automatically.
64 Furthermore in interactive mode the output of atop can be controlled by
66 pressing particular keys. However it is also possible to specify such
67 key as flag on the command line. In that case atop switches to the in‐
68 dicated mode on beforehand; this mode can be modified again interac‐
69 tively. Specifying such key as flag is especially useful when running
70 atop with output to a pipe or file (non-interactively). These flags
71 are the same as the keys that can be pressed in interactive mode (see
72 section INTERACTIVE COMMANDS).
73 Additional flags are available to support storage of atop-data in raw
74 format (see section RAW DATA STORAGE).
75
77 With every interval, atop reads the kernel administration to obtain in‐
78 formation about all running processes. However, it is likely that dur‐
79 ing the interval also processes have terminated. These processes might
80 have consumed system resources during this interval as well before they
81 terminated. Therefore, atop tries to read the process accounting
82 records that contain the accounting information of terminated processes
83 and report these processes too. Only when the process accounting mech‐
84 anism in the kernel is activated, the kernel writes such process ac‐
85 counting record to a file for every process that terminates.
86 There are various ways for atop to get access to the process accounting
88 records (tried in this order):
89 1. When the environment variable ATOPACCT is set, it specifies the
91 name of the process accounting file. In that case, process ac‐
92 counting for this file should have been activated on beforehand.
93 Before opening this file for reading, atop drops its root privi‐
94 leges (if any).
95 When this environment variable is present but its contents is
96 empty, process accounting will not be used at all.
97 2. This is the preferred way of handling process accounting records!
99 When the atopacctd daemon is active, it has activated the process
100 accounting mechanism in the kernel and transfers to original ac‐
101 counting records to shadow files. In that case, atop drops its
102 root privileges and opens the current shadow file for reading.
103 This way is preferred, because the atopacctd daemon maintains full
104 control of the size of the original process accounting file written
105 by the kernel and the shadow files read by the atop process(es).
106 The atopacct service will be activated before the atop service to
108 enable atop to detect that process accounting is managed by the
109 atopacctd daemon. As a forking service, atopacctd takes care that
110 all directories and files are initialized before the parent process
111 dies. The child process continues as the daemon process.
112 For further information, refer to the atopacctd man page.
114 3. When the atopacctd daemon is not active, atop verifies if the
116 process accounting mechanism has been switched on via the separate
117 psacct or acct package (the package name depends on the Linux dis‐
118 tro). In that case, one of the files /var/log/pacct, /var/ac‐
119 count/pacct or /var/log/account/pacct is in use as process account‐
120 ing file and atop opens this file for reading.
121 4. As a last possibility, atop itself tries to activate the process
123 accounting mechanism (requires root privileges) using the file
124 /var/cache/atop.d/atop.acct (to be written by the kernel, to be
125 read by atop itself). Process accounting remains active as long as
126 at least one atop process is alive. Whenever the last atop process
127 stops (either by pressing `q' or by `kill -15'), it deactivates the
128 process accounting mechanism again. Therefore you should never ter‐
129 minate atop by `kill -9', because then it has no chance to stop
130 process accounting. As a result, the accounting file may consume a
131 lot of disk space after a while.
132 To avoid that the process accounting file consumes too much disk
133 space, atop verifies at the end of every sample if the size of the
134 process accounting file exceeds 200 MiB and if this atop process is
135 the only one that is currently using the file. In that case the
136 file is truncated to a size of zero.
137 Notice that root-privileges are required to switch on/off process
139 accounting in the kernel. You can start atop as a root user or
140 specify setuid-root privileges to the executable file. In the lat‐
141 ter case, atop switches on process accounting and drops the root-
142 privileges again.
143 If atop does not run with root-privileges, it does not show infor‐
144 mation about finished processes. It indicates this situation with
145 the message message `no procacct` in the top-right corner (instead
146 of the counter that shows the number of exited processes).
147 When during one interval a lot of processes have finished, atop might
149 grow tremendously in memory when reading all process accounting records
150 at the end of the interval. To avoid such excessive growth, atop will
151 never read more than 50 MiB with process information from the process
152 accounting file per interval (approx. 70000 finished processes). In
153 interactive mode a warning is given whenever processes have been
154 skipped for this reason.
155
157 For the resource consumption on system level, atop uses colors to indi‐
158 cate that a critical occupation percentage has been (almost) reached.
159 A critical occupation percentage means that is likely that this load
160 causes a noticeable negative performance influence for applications us‐
161 ing this resource. The critical percentage depends on the type of re‐
162 source: e.g. the performance influence of a disk with a busy percentage
163 of 80% might be more noticeable for applications/user than a CPU with a
164 busy percentage of 90%.
165 Currently atop uses the following default values to calculate a
166 weighted percentage per resource:
167 Processor
169 A busy percentage of 90% or higher is considered `critical'.
170 Disk
172 A busy percentage of 70% or higher is considered `critical'.
173 Network
175 A busy percentage of 90% or higher for the load of an interface is
176 considered `critical'.
177 Memory
179 An occupation percentage of 90% is considered `critical'. Notice
180 that this occupation percentage is the accumulated memory consump‐
181 tion of the kernel (including slab) and all processes; the memory
182 for the page cache (`cache' and `buff' in the MEM-line) and the
183 reclaimable part of the slab (`slrec`) is not implied!
184 If the number of pages swapped out (`swout' in the PAG-line) is
185 larger than 10 per second, the memory resource is considered
186 `critical'. A value of at least 1 per second is considered `al‐
187 most critical'.
188 If the committed virtual memory exceeds the limit (`vmcom' and
189 `vmlim' in the SWP-line), the SWP-line is colored due to overcom‐
190 mitting the system.
191 Swap
193 An occupation percentage of 80% is considered `critical' because
194 swap space might be completely exhausted in the near future; it is
195 not critical from a performance point-of-view.
196 These default values can be modified in the configuration file (see
198 separate man-page of atoprc).
199 When a resource exceeds its critical occupation percentage, the con‐
201 cerning values in the screen line are colored red by default.
202 When a resource exceeded (default) 80% of its critical percentage (so
203 it is almost critical), the concerning values in the screen line are
204 colored cyan by default. This `almost critical percentage' (one value
205 for all resources) can be modified in the configuration file (see sepa‐
206 rate man-page of atoprc).
207 The default colors red and cyan can be modified in the configuration
208 file as well (see separate man-page of atoprc).
209 With the key 'x' (or flag -x), the use of colors can be suppressed.
211
213 Per-process and per-thread network activity can be measured by the ne‐
214 tatop kernel module. You can download this kernel module from the web‐
215 site (mentioned at the end of this manual page) and install it on your
216 system if the kernel version is 2.6.24 or newer.
217 When atop gathers counters for a new interval, it verifies if the ne‐
218 tatop module is currently active. If so, atop obtains the relevant net‐
219 work counters from this module and shows the number of sent and re‐
220 ceived packets per process/thread in the generic screen. Besides, de‐
221 tailed counters can be requested by pressing the `n' key.
222 When the netatopd daemon is running as well, atop also reads the net‐
223 work counters of exited processes that are logged by this daemon (com‐
224 parable with process accounting).
225 More information about the optional netatop kernel module and the ne‐
227 tatopd daemon can be found in the concerning man-pages and on the web‐
228 site mentioned at the end of this manual page.
229
231 GPU statistics can be gathered by atopgpud which is a separate data
232 collection daemon process. It gathers cumulative utilization counters
233 of every Nvidia GPU in the system, as well as utilization counters of
234 every process that uses a GPU. When atop notices that the daemon is
235 active, it reads these GPU utilization counters with every interval.
236 The atopgpud daemon is written in Python, so a Python interpreter
238 should be installed on the target system. The Python code of the daemon
239 is compatible with Python version 2 and version 3. For the gathering
240 of the statistics, the pynvml module is used by the daemon. Be sure
241 that this module is installed on the target system before activating
242 the daemon, by running the command as root pip (the command pip might
243 be exchanged by pip3 in case of Python3):
244 pip install nvidia-ml-py
246 The atopgpud daemon is installed by default as part of the atop pack‐
248 age, but it is not automatically enabled. The daemon can be enabled
249 and started now by running the following commands (as root):
250 systemctl enable atopgpu
252 systemctl start atopgpu
253 Find a description about the utilization counters in the section OUTPUT
255 DESCRIPTION.
256
258 When running atop interactively (no output redirection), keys can be
259 pressed to control the output. In general, lower case keys can be used
260 to show other information for the active processes and upper case keys
261 can be used to influence the sort order of the active process/thread
262 list.
263 g Show generic output (default).
265 Per process the following fields are shown in case of a window-
267 width of 80 positions: process-id, cpu consumption during the last
268 interval in system and user mode, the virtual and resident memory
269 growth of the process.
270 The subsequent columns depend on the used kernel:
272 When the kernel supports "storage accounting" (>= 2.6.20), the
273 data transfer for read/write on disk, the status and exit code are
274 shown for each process. When the kernel does not support "storage
275 accounting", the username, number of threads in the thread group,
276 the status and exit code are shown.
277 When the kernel module 'netatop' is loaded, the data transfer for
278 send/receive of network packets is shown for each process.
279 The last columns contain the state, the occupation percentage for
280 the chosen resource (default: cpu) and the process name.
281 When more than 80 positions are available, other information is
283 added.
284 m Show memory related output.
286 Per process the following fields are shown in case of a window-
288 width of 80 positions: process-id, minor and major memory faults,
289 size of virtual shared text, total virtual process size, total
290 resident process size, virtual and resident growth during last in‐
291 terval, memory occupation percentage and process name.
292 When more than 80 positions are available, other information is
294 added.
295 For memory consumption, always all processes are shown (also the
297 processes that were not active during the interval).
298 d Show disk-related output.
300 When "storage accounting" is active in the kernel, the following
302 fields are shown: process-id, amount of data read from disk,
303 amount of data written to disk, amount of data that was written
304 but has been withdrawn again (WCANCL), disk occupation percentage
305 and process name.
306 n Show network related output.
308 Per process the following fields are shown in case of a window-
310 width of 80 positions: process-id, thread-id, total bandwidth for
311 received packets, total bandwidth for sent packets, number of re‐
312 ceived TCP packets with the average size per packet (in bytes),
313 number of sent TCP packets with the average size per packet (in
314 bytes), number of received UDP packets with the average size per
315 packet (in bytes), number of sent UDP packets with the average
316 size per packet (in bytes), the network occupation percentage and
317 process name.
318 This information can only be shown when kernel module `netatop' is
319 installed.
320 When more than 80 positions are available, other information is
322 added.
323 s Show scheduling characteristics.
325 Per process the following fields are shown in case of a window-
327 width of 80 positions: process-id, number of threads in state
328 'running' (R), number of threads in state 'interruptible sleeping'
329 (S), number of threads in state 'uninterruptible sleeping' (D),
330 scheduling policy (normal timesharing, realtime round-robin, real‐
331 time fifo), nice value, priority, realtime priority, current pro‐
332 cessor, status, exit code, state, the occupation percentage for
333 the chosen resource and the process name.
334 When more than 80 positions are available, other information is
336 added.
337 v Show various process characteristics.
339 Per process the following fields are shown in case of a window-
341 width of 80 positions: process-id, user name and group, start date
342 and time, status (e.g. exit code if the process has finished),
343 state, the occupation percentage for the chosen resource and the
344 process name.
345 When more than 80 positions are available, other information is
347 added.
348 c Show the command line of the process.
350 Per process the following fields are shown: process-id, the occu‐
352 pation percentage for the chosen resource and the command line in‐
353 cluding arguments.
354 X Show cgroup v2 information.
356 Per process the following fields are shown: process-id,
358 `cpu.weight' of the cgroup the process belongs to, `cpu.max' value
359 (recalculated as percentage) of the cgroup the process belongs to,
360 most restrictive `cpu.max' value found in the upper directories,
361 `memory.max' value of the cgroup the process belongs to, most re‐
362 strictive `memory.max' value found in the upper directories, `mem‐
363 ory.swap.max' value of the cgroup the process belongs to, most re‐
364 strictive `memory.swap.max' value found in the upper directories,
365 the command name, and the cgroup path name (horizontally scrol‐
366 lable).
367 e Show GPU utilization.
369 Per process at least the following fields are shown: process-id,
371 range of GPU numbers on which the process currently runs, GPU busy
372 percentage on all GPUs, memory busy percentage (i.e. read and
373 write accesses on memory) on all GPUs, memory occupation at the
374 moment of the sample, average memory occupation during the sample,
375 and GPU percentage.
376 When the atopgpud daemon does not run with root privileges, the
378 GPU busy percentage and the memory busy percentage are not avail‐
379 able on process level. In that case, the GPU percentage on
380 process level reflects the GPU memory occupation instead of the
381 GPU busy percentage (which is preferred).
382 o Show the user-defined line of the process.
384 In the configuration file the keyword ownprocline can be specified
386 with the description of a user-defined output-line.
387 Refer to the man-page of atoprc for a detailed description.
388 y Show the individual threads within a process (toggle).
390 Single-threaded processes are still shown as one line.
392 For multi-threaded processes, one line represents the process
393 while additional lines show the activity per individual thread (in
394 a different color). Depending on the option 'a' (all or active
395 toggle), all threads are shown or only the threads that were ac‐
396 tive during the last interval. Depending on the option 'Y' (sort
397 threads), the threads per process will be sorted on the chosen
398 sort criterium or not.
399 Whether this key is active or not can be seen in the header line.
400 Y Sort the threads per process when combined with option 'y' (tog‐
402 gle).
403 u Show the process activity accumulated per user.
405 Per user the following fields are shown: number of processes ac‐
407 tive or terminated during last interval (or in total if combined
408 with command `a'), accumulated cpu consumption during last inter‐
409 val in system and user mode, the current virtual and resident mem‐
410 ory space consumed by active processes (or all processes of the
411 user if combined with command `a').
412 When "storage accounting" is active in the kernel, the accumulated
413 read and write throughput on disk is shown. When the kernel mod‐
414 ule `netatop' has been installed, the number of received and sent
415 network packets are shown.
416 The last columns contain the accumulated occupation percentage for
417 the chosen resource (default: cpu) and the user name.
418 p Show the process activity accumulated per program (i.e. process
420 name).
421 Per program the following fields are shown: number of processes
423 active or terminated during last interval (or in total if combined
424 with command `a'), accumulated cpu consumption during last inter‐
425 val in system and user mode, the current virtual and resident mem‐
426 ory space consumed by active processes (or all processes of the
427 user if combined with command `a').
428 When "storage accounting" is active in the kernel, the accumulated
429 read and write throughput on disk is shown. When the kernel mod‐
430 ule `netatop' has been installed, the number of received and sent
431 network packets are shown.
432 The last columns contain the accumulated occupation percentage for
433 the chosen resource (default: cpu) and the program name.
434 j Show the process activity accumulated per Docker container.
436 Per container the following fields are shown: number of processes
438 active or terminated during last interval (or in total if combined
439 with command `a'), accumulated cpu consumption during last inter‐
440 val in system and user mode, the current virtual and resident mem‐
441 ory space consumed by active processes (or all processes of the
442 user if combined with command `a').
443 When "storage accounting" is active in the kernel, the accumulated
444 read and write throughput on disk is shown. When the kernel mod‐
445 ule `netatop' has been installed, the number of received and sent
446 network packets are shown.
447 The last columns contain the accumulated occupation percentage for
448 the chosen resource (default: cpu) and the Docker container id
449 (CID).
450 C Sort the current list in the order of cpu consumption (default).
452 The one-but-last column changes to ``CPU''.
453 E Sort the current list in the order of GPU utilization (preferred,
455 but only applicable when the atopgpud daemon runs under root priv‐
456 ileges) or the order of GPU memory occupation). The one-but-last
457 column changes to ``GPU''.
458 M Sort the current list in the order of resident memory consumption.
460 The one-but-last column changes to ``MEM''. In case of sorting on
461 memory, the full process list will be shown (not only the active
462 processes).
463 D Sort the current list in the order of disk accesses issued. The
465 one-but-last column changes to ``DSK''.
466 N Sort the current list in the order of network bandwidth (received
468 and transmitted). The one-but-last column changes to ``NET''.
469 A Sort the current list automatically in the order of the most busy
471 system resource during this interval. The one-but-last column
472 shows either ``ACPU'', ``AMEM'', ``ADSK'' or ``ANET'' (the preced‐
473 ing 'A' indicates automatic sorting-order). The most busy re‐
474 source is determined by comparing the weighted busy-percentages of
475 the system resources, as described earlier in the section COLORS.
476 This option remains valid until another sorting-order is explic‐
477 itly selected again.
478 A sorting-order for disk is only possible when "storage account‐
479 ing" is active. A sorting-order for network is only possible when
480 the kernel module `netatop' is loaded.
481 Miscellaneous interactive commands:
483 ? Request for help information (also the key 'h' can be pressed).
485 V Request for version information (version number and date).
487 R Gather and calculate the proportional set size of processes (tog‐
489 gle). Gathering of all values that are needed to calculate the
490 PSIZE of a process is a very time-consuming task, so this key
491 should only be active when analyzing the resident memory consump‐
492 tion of processes.
493 W Get the WCHAN per thread (toggle). Gathering of the WCHAN string
495 per thread is a relatively time-consuming task, so this key should
496 only be made active when analyzing the reason for threads to be in
497 sleep state.
498 x Suppress colors to highlight critical resources (toggle).
500 Whether this key is active or not can be seen in the header line.
501 z The pause key can be used to freeze the current situation in order
503 to investigate the output on the screen. While atop is paused, the
504 keys described above can be pressed to show other information
505 about the current list of processes. Whenever the pause key is
506 pressed again, atop will continue with a next sample.
507 i Modify the interval timer (default: 10 seconds). If an interval
509 timer of 0 is entered, the interval timer is switched off. In that
510 case a new sample can only be triggered manually by pressing the
511 key 't'.
512 t Trigger a new sample manually. This key can be pressed if the cur‐
514 rent sample should be finished before the timer has exceeded, or
515 if no timer is set at all (interval timer defined as 0). In the
516 latter case atop can be used as a stopwatch to measure the load
517 being caused by a particular application transaction, without
518 knowing on beforehand how many seconds this transaction will last.
519 When viewing the contents of a raw file this key can be used to
521 show the next sample from the file. This key can also be used when
522 viewing raw data via a pipe.
523 T When viewing the contents of a raw file this key can be used to
525 show the previous sample from the file, however not when reading
526 raw data from a pipe.
527 b When viewing the contents of a raw file, this key can be used to
529 branch to a certain timestamp within the file either forward or
530 backward. When viewing raw data from a pipe only forward branches
531 are possible.
532 r Reset all counters to zero to see the system and process activity
534 since boot again.
535 When viewing the contents of a raw file, this key can be used to
537 rewind to the beginning of the file again (except when reading raw
538 data from a pipe).
539 U Specify a search string for specific user names as a regular ex‐
541 pression. From now on, only (active) processes will be shown from
542 a user which matches the regular expression. The system statis‐
543 tics are still system wide. If the Enter-key is pressed without
544 specifying a name, (active) processes of all users will be shown
545 again.
546 Whether this key is active or not can be seen in the header line.
547 I Specify a list with one or more PIDs to be selected. From now on,
549 only processes will be shown with a PID which matches one of the
550 given list. The system statistics are still system wide. If the
551 Enter-key is pressed without specifying a PID, all (active) pro‐
552 cesses will be shown again.
553 Whether this key is active or not can be seen in the header line.
554 P Specify a search string for specific process names as a regular
556 expression. From now on, only processes will be shown with a name
557 which matches the regular expression. The system statistics are
558 still system wide. If the Enter-key is pressed without specifying
559 a name, all (active) processes will be shown again.
560 Whether this key is active or not can be seen in the header line.
561 / Specify a specific command line search string as a regular expres‐
563 sion. From now on, only processes will be shown with a command
564 line which matches the regular expression. The system statistics
565 are still system wide. If the Enter-key is pressed without speci‐
566 fying a string, all (active) processes will be shown again.
567 Whether this key is active or not can be seen in the header line.
568 J Specify a Docker container id of 12 (hexadecimal) characters.
570 From now on, only processes will be shown that run in that spe‐
571 cific Docker container (CID). The system statistics are still
572 system wide. If the Enter-key is pressed without specifying a
573 container id, all (active) processes will be shown again.
574 Whether this key is active or not can be seen in the header line.
575 Q Specify a comma-separated list of process/thread state characters.
577 From now on, only processes/threads will be shown that are in
578 those specific states. Accepted states are: R (running), S
579 (sleeping), D (disk sleep), I (idle), T (stopped), t (tracing
580 stop), X (dead), Z (zombie) and P (parked). The system statistics
581 are still system wide. If the Enter-key is pressed without speci‐
582 fying a state, all (active) processes/threads will be shown again.
583 Whether this key is active or not can be seen in the header line.
584 S Specify search strings for specific logical volume names, specific
586 disk names and specific network interface names. All search
587 strings are interpreted as a regular expressions. From now on,
588 only those system resources are shown that match the concerning
589 regular expression. If the Enter-key is pressed without specify‐
590 ing a search string, all (active) system resources of that type
591 will be shown again.
592 Whether this key is active or not can be seen in the header line.
593 a The `all/active' key can be used to toggle between only show‐
595 ing/accumulating the processes that were active during the last
596 interval (default) or showing/accumulating all processes.
597 Whether this key is active or not can be seen in the header line.
598 G By default, atop shows/accumulates the processes that are alive
600 and the processes that are exited during the last interval. With
601 this key (toggle), showing/accumulating the processes that are ex‐
602 ited can be suppressed.
603 Whether this key is active or not can be seen in the header line.
604 f Show a fixed (maximum) number of header lines for system resources
606 (toggle). By default only the lines are shown about system re‐
607 sources (CPUs, paging, logical volumes, disks, network interfaces)
608 that really have been active during the last interval. With this
609 key you can force atop to show lines of inactive resources as
610 well.
611 Whether this key is active or not can be seen in the header line.
612 F Suppress sorting of system resources (toggle). By default system
614 resources (CPUs, logical volumes, disks, network interfaces) are
615 sorted on utilization.
616 Whether this key is active or not can be seen in the header line.
617 1 Show relevant counters as an average per second (in the format
619 `..../s') instead of as a total during the interval (toggle).
620 Whether this key is active or not can be seen in the header line.
621 l Limit the number of system level lines for the counters per-cpu,
623 the active disks and the network interfaces. By default lines are
624 shown of all CPUs, disks and network interfaces which have been
625 active during the last interval. Limiting these lines can be use‐
626 ful on systems with huge number CPUs, disks or interfaces in order
627 to be able to run atop on a screen/window with e.g. only 24 lines.
628 For all mentioned resources the maximum number of lines can be
629 specified interactively. When using the flag -l the maximum number
630 of per-cpu lines is set to 0, the maximum number of disk lines to
631 5 and the maximum number of interface lines to 3. These values
632 can be modified again in interactive mode.
633 k Send a signal to an active process (a.k.a. kill a process).
635 q Quit the program.
637 PgDn Show the next page of the process/thread list.
639 With the arrow-down key the list can be scrolled downwards with
640 single lines.
641 ^F Show the next page of the process/thread list (forward).
643 With the arrow-down key the list can be scrolled downwards with
644 single lines.
645 PgUp Show the previous page of the process/thread list.
647 With the arrow-up key the list can be scrolled upwards with single
648 lines.
649 ^B Show the previous page of the process/thread list (backward).
651 With the arrow-up key the list can be scrolled upwards with single
652 lines.
653 ^L Redraw the screen.
655
657 In order to store system and process level statistics for long-term
658 analysis (e.g. to check the system load and the active processes run‐
659 ning yesterday between 3:00 and 4:00 PM), atop can store the system and
660 process level statistics in compressed binary format in a raw file with
661 the flag -w followed by the filename. If this file already exists and
662 is recognized as a raw data file, atop will append new samples to the
663 file (starting with a sample which reflects the activity since boot);
664 if the file does not exist, it will be created.
665 All information about processes and threads is stored in the raw file.
666 The interval (default: 10 seconds) and number of samples (default: in‐
667 finite) can be passed as last arguments. Instead of the number of sam‐
668 ples, the flag -S can be used to indicate that atop should finish any‐
669 how before midnight.
670 A raw file can be read and visualized again with the flag -r followed
672 by the filename. If no filename is specified, the file
673 /var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are
674 digits representing the current date). If a filename is specified in
675 the format YYYYMMDD (representing any valid date), the file
676 /var/log/atop/atop_YYYYMMDD is opened. If a filename with the symbolic
677 name y is specified, yesterday's daily logfile is opened (this can be
678 repeated so 'yyyy' indicates the logfile of four days ago). If the
679 filename - is used, stdin will be read.
680 The samples from the file can be viewed interactively by using the key
681 't' to show the next sample, the key 'T' to show the previous sample,
682 the key 'b' to branch to a particular time or the key 'r' to rewind to
683 the begin of the file.
684 When output is redirected to a file or pipe, atop prints all samples in
685 plain ASCII. The default line length is 80 characters in that case;
686 with the flag -L followed by an alternate line length, more (or less)
687 columns will be shown.
688 With the flag -b (begin time) and/or -e (end time) followed by a time
689 argument of the form [YYYYMMDD]hhmm, a certain time period within the
690 raw file can be selected.
691 Every day at midnight atop is restarted by the atop-rotate.timer and
693 atop-rotate.service unit files, to write compressed binary data to the
694 file /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes by de‐
695 fault.
696 Furthermore all raw files are removed that are older than 28 days (by
697 default).
698 The mentioned default values can be overruled in the file /etc/de‐
699 fault/atop that might contain other values for LOGOPTS (by default
700 without any flag), LOGINTERVAL (in seconds, by default 600), LOGGENERA‐
701 TIONS (in days, by default 28), and LOGPATH (directory in which log‐
702 files are stored).
703 Unfortunately, it is not always possible to keep the format of the raw
705 files compatible in newer versions of atop especially when lots of new
706 counters have to be maintained. Therefore, the program atopconvert is
707 installed to convert a raw file created by an older version of atop to
708 a raw file that can be read by a newer version of atop (see the man
709 page of atopconvert for more details).
710
713 The first sample shows the system level activity since boot (the
714 elapsed time in the header shows the time since boot). Note that par‐
715 ticular counters could have reached their maximum value (several times)
716 and started by zero again, so do not rely on these figures.
717 For every sample atop first shows the lines related to system level ac‐
719 tivity. If a particular system resource has not been used during the
720 interval, the entire line related to this resource is suppressed. So
721 the number of system level lines may vary for each sample.
722 After that a list is shown of processes which have been active during
723 the last interval. This list is by default sorted on cpu consumption,
724 but this order can be changed by the keys which are previously de‐
725 scribed.
726 If values have to be shown by atop which do not fit in the column
728 width, another format is used. If e.g. a cpu-consumption of 233216 mil‐
729 liseconds should be shown in a column width of 4 positions, it is shown
730 as `233s' (in seconds). For large memory figures, another unit is cho‐
731 sen if the value does not fit (Mb instead of Kb, Gb instead of Mb, Tb
732 instead of Gb, ...). For other values, a kind of exponent notation is
733 used (value 123456789 shown in a column of 5 positions gives 123e6).
734
736 The system level information consists of the following output lines:
737 PRC Process and thread level totals.
739 This line contains the total cpu time consumed in system mode
740 (`sys') and in user mode (`user'), the total number of processes
741 present at this moment (`#proc'), the total number of threads
742 present at this moment in state `running' (`#trun'), `sleeping in‐
743 terruptible' (`#tslpi') and `sleeping uninterruptible' (`#tslpu'),
744 the number of zombie processes (`#zombie'), the number of clone
745 system calls (`clones'), and the number of processes that ended
746 during the interval (`#exit') when process accounting is used. In‐
747 stead of `#exit` the last column may indicate that process ac‐
748 counting could not be activated (`no procacct`).
749 If the screen-width does not allow all of these counters, only a
750 relevant subset is shown.
751 CPU CPU utilization.
753 At least one line is shown for the total occupation of all CPUs
754 together.
755 In case of a multi-processor system, an additional line is shown
756 for every individual processor (with `cpu' in lower case), sorted
757 on activity. Inactive CPUs will not be shown by default. The
758 lines showing the per-cpu occupation contain the cpu number in the
759 field combined with the wait percentage.
760 Every line contains the percentage of cpu time spent in kernel
762 mode by all active processes (`sys'), the percentage of cpu time
763 consumed in user mode (`user') for all active processes (including
764 processes running with a nice value larger than zero), the per‐
765 centage of cpu time spent for interrupt handling (`irq') including
766 softirq, the percentage of unused cpu time while no processes were
767 waiting for disk I/O (`idle'), and the percentage of unused cpu
768 time while at least one process was waiting for disk I/O (`wait').
769 In case of per-cpu occupation, the cpu number and the wait per‐
770 centage (`w') for that cpu. The number of lines showing the per-
771 cpu occupation can be limited.
772 For virtual machines, the steal-percentage (`steal') shows the
774 percentage of cpu time stolen by other virtual machines running on
775 the same hardware.
776 For physical machines hosting one or more virtual machines, the
777 guest-percentage (`guest') shows the percentage of cpu time used
778 by the virtual machines. Notice that this percentage overlaps the
779 user percentage!
780 When PMC performance monitoring counters are supported by the CPU
782 and the kernel (and atop runs with root privileges), the number of
783 instructions per CPU cycle (`ipc') is shown. The first sample al‐
784 ways shows the value 'initial', because the counters are just ac‐
785 tivated at the moment that atop is started.
786 When the CPU busy percentage is high and the IPC is less than 1.0,
787 it is likely that the CPU is frequently waiting for memory access
788 during instruction execution (larger CPU caches or faster memory
789 might be helpful to improve performance). When the CPU busy per‐
790 centage is high and the IPC is greater than 1.0, it is likely that
791 the CPU is instruction-bound (more/faster cores might be helpful
792 to improve performance).
793 Furthermore, per CPU the effective number of cycles (`cycl') is
794 shown. This value can reach the current CPU frequency if such CPU
795 is 100% busy. When an idle CPU is halted, the number of effective
796 cycles can be (considerably) lower than the current frequency.
797 Notice that the average instructions per cycle and number of cy‐
798 cles is shown in the CPU line for all CPUs.
799 Beware that reading the cycle counter in virtual machines (guests)
800 might introduce performance delays. Therefore this metric is by
801 default disabled in virtual machines. However, with the keyword
802 'perfevents' in the atoprc file this metric can be explicitly set
803 to 'enable' or 'disable' (see separate man-page of atoprc).
804 See also: http://www.brendangregg.com/blog/2017-05-09/cpu-utiliza‐
805 tion-is-wrong.html
806 In case of frequency scaling, all previously mentioned CPU per‐
809 centages are relative to the used scaling of the CPU during the
810 interval. If a CPU has been active for e.g. 50% in user mode dur‐
811 ing the interval while the frequency scaling of that CPU was 40%,
812 only 20% of the full capacity of the CPU has been used in user
813 mode.
814 In case that the kernel module `cpufreq_stats' is active (after
815 issuing `modprobe cpufreq_stats'), the average frequency (`avgf')
816 and the average scaling percentage (`avgscal') is shown. Otherwise
817 the current frequency (`curf') and the current scaling percentage
818 (`curscal') is shown at the moment that the sample is taken. No‐
819 tice that average values for frequency and scaling are shown in
820 the CPU line for every CPU.
821 Frequency scaling statistics are only gathered for systems with
822 maximum 8 CPUs, since gathering of these values per CPU is very
823 time consuming.
824 If the screen-width does not allow all of these counters, only a
826 relevant subset is shown.
827 CPL CPU load information.
829 This line contains the load average figures reflecting the number
830 of threads that are available to run on a CPU (i.e. part of the
831 runqueue) or that are waiting for disk I/O. These figures are av‐
832 eraged over 1 (`avg1'), 5 (`avg5') and 15 (`avg15') minutes.
833 Furthermore the number of context switches (`csw'), the number of
834 serviced interrupts (`intr') and the number of available CPUs are
835 shown.
836 If the screen-width does not allow all of these counters, only a
838 relevant subset is shown.
839 GPU GPU utilization (Nvidia).
841 Read the section GPU STATISTICS GATHERING in this document to find
842 the details about the activation of the atopgpud daemon.
843 In the first column of every line, the bus-id (last nine charac‐
845 ters) and the GPU number are shown. The subsequent columns show
846 the percentage of time that one or more kernels were executing on
847 the GPU (`gpubusy'), the percentage of time that global (device)
848 memory was being read or written (`membusy'), the occupation per‐
849 centage of memory (`memocc'), the total memory (`total'), the mem‐
850 ory being in use at the moment of the sample (`used'), the average
851 memory being in use during the sample time (`usavg'), the number
852 of processes being active on the GPU at the moment of the sample
853 (`#proc'), and the type of GPU.
854 If the screen-width does not allow all of these counters, only a
856 relevant subset is shown.
857 The number of lines showing the GPUs can be limited.
858 MEM Memory occupation (two lines).
860 These lines contain the total amount of physical memory (`tot'),
861 the amount of memory which is currently free (`free'), the amount
862 of memory in use as page cache including the total resident shared
863 memory (`cache'), the amount of memory within the page cache that
864 has to be flushed to disk (`dirty'), the amount of memory used for
865 filesystem meta data (`buff'), the amount of memory being used for
866 kernel mallocs (`slab'), the amount of slab memory that is re‐
867 claimable (`slrec'), the resident size of shared memory including
868 tmpfs (`shmem'), the resident size of shared memory (`shrss') the
869 amount of shared memory that is currently swapped (`shswp'), the
870 amount of memory that is currently used for page tables (`pgtab'),
871 the number of NUMA nodes in this system (`numnode'), the amount of
872 memory that is currently claimed by vmware's balloon driver (`vm‐
873 bal'), the amount of memory that is currently claimed by the ARC
874 (cache) of ZFSonlinux (`zfarc'), the amount of memory that is
875 claimed for huge pages (`hptot'), the amount of huge page memory
876 that is really in use (`hpuse'), the amount of memory that is used
877 for TCP sockets (`tcps'), and the amount of memory that is used
878 for UDP sockets (`udps').
879 If the screen-width does not allow all of these counters, only a
881 relevant subset is shown.
882 SWP Swap occupation and overcommit info.
884 This line contains the total amount of swap space on disk (`tot'),
885 the amount of free swap space (`free'), the size of the swap cache
886 (`swcac'), the total size of compressed storage in zswap
887 (`zpool`), the total size of the compressed pages stored in zswap
888 (`zstor'), the total size of the memory used for KSM (`ksuse`,
889 i.e. shared), and the total size of the memory saved (deduped) by
890 KSM (`kssav`, i.e. sharing).
891 Furthermore the committed virtual memory space (`vmcom') and the
892 maximum limit of the committed space (`vmlim', which is by default
893 swap size plus 50% of memory size) is shown. The committed space
894 is the reserved virtual space for all allocations of private mem‐
895 ory space for processes. The kernel only verifies whether the com‐
896 mitted space exceeds the limit if strict overcommit handling is
897 configured (vm.overcommit_memory is 2).
898 LLC Last-Level Cache of CPU info.
900 This line contains the total memory bandwidth of LLC (`tot'), the
901 bandwidth of the local NUMA node (`loc'), and the percentage of
902 LLC in use (`LLCXX YY%').
903 Note that this feature depends on the `resctrl` pseudo filesystem.
905 Be sure that the kernel is built with the relevant config and take
906 care that the pseudo-filesystem is mounted:
907 mount -t resctrl resctrl -o mba_MBps /sys/fs/resctrl (on Intel)
909 mount -t resctrl resctrl -o cdp /sys/fs/resctrl (on AMD)
910 NUM Memory utilization per NUMA node (not shown for single NUMA node).
912 This line shows the total amount of physical memory of this node
913 (`tot'), the amount of free memory (`free'), the amount of memory
914 for cached file data (`file'), modified cached file data
915 (`dirty'), recently used memory (`activ'), less recently used mem‐
916 ory (`inact'), memory being used for kernel mallocs (`slab'), the
917 amount of slab memory that is reclaimable (`slrec'), shared memory
918 including tmpfs (`shmem'), total huge pages (`hptot') and the
919 fragmentation percentage (`frag').
920 NUC CPU utilization per NUMA node (not shown for single NUMA node).
922 This line shows the utilization percentages of all CPUs related to
923 this NUMA node, categorized for system mode (`sys'), user mode
924 (`user'), user mode for niced processes (`niced'), idle mode
925 (`idle'), wait mode (`w' preceded by the node number), irq mode
926 (`irq'), softirq mode (`sirq'), steal mode (`steal'), and guest
927 mode (`guest') overlapping user mode.
928 PAG Paging frequency.
930 This line contains the number of scanned pages (`scan') due to the
931 fact that free memory drops below a particular threshold, the num‐
932 ber times that the kernel tries to reclaim pages due to an urgent
933 need (`stall'), the number of process stalls to run memory com‐
934 paction to allocate huge pages (`compact'), the number of NUMA
935 pages migrated (`numamig'), and the total number of memory pages
936 migrated successfully e.g. between NUMA nodes or for compaction
937 (`migrate') are shown.
938 Also the number of memory pages the system read from block devices
939 (`pgin'), the number of memory pages the system wrote to block de‐
940 vices (`pgout'), the number of memory pages the system read from
941 swap space (`swin'), the number of memory pages the system wrote
942 to swap space (`swout'), and the number of out-of-memory kills
943 (`oomkill').
944 PSI Pressure Stall Information.
946 This line contains percentages about resource pressure related to
947 CPU, memory and I/O. Certain percentages refer to 'some' meaning
948 that some processes/threads were delayed due to resource overload.
949 Other percentages refer to 'full' meaning a loss of overall
950 throughput due to resource overload.
951 The values `cpusome', `memsome', `memfull', `iosome' and `iofull'
952 show the pressure percentage during the entire interval.
953 The values `cs' (cpu some), `ms' (memory some), `mf' (memory
954 full), `is' (I/O some) and `if' (I/O full) each show three per‐
955 centages separated by slashes: pressure percentage over the last
956 10, 60 and 300 seconds.
957 LVM/MDD/DSK
959 Logical volume/multiple device/disk utilization.
960 Per active unit one line is produced, sorted on unit activity.
961 Such line shows the name (e.g. VolGroup00-lvtmp for a logical vol‐
962 ume or sda for a hard disk), the percentage of elapsed time during
963 which I/O requests were issued to the device (`busy') (note that
964 for devices serving requests in parallel, such as RAID arrays, SSD
965 and NVMe, this number does not reflect their performance limits),
966 the number of read requests issued (`read'), the number of write
967 requests issued (`write'), the number of discard requests issued
968 (`discrd') if supported by kernel version, the number of KiBytes
969 per read (`KiB/r'), the number of KiBytes per write (`KiB/w'), the
970 number of KiBytes per discard (`KiB/d') if supported by kernel
971 version, the number of MiBytes per second throughput for reads
972 (`MBr/s'), the number of MiBytes per second throughput for writes
973 (`MBw/s'), requests issued to the device driver but not completed
974 (`inflt'), the average queue depth while busy (`avq') and the av‐
975 erage number of milliseconds needed by a request (`avio') for
976 seek, latency and data transfer.
977 If the screen-width does not allow all of these counters, only a
978 relevant subset is shown.
979 The number of lines showing the units can be limited per class
981 (LVM, MDD or DSK) with the 'l' key or statically (see separate
982 man-page of atoprc). By specifying the value 0 for a particular
983 class, no lines will be shown any more for that class.
984 NFM Network Filesystem (NFS) mount at the client side.
986 For each NFS-mounted filesystem, a line is shown that contains the
987 mounted server directory, the name of the server (`srv'), the to‐
988 tal number of bytes physically read from the server (`read') and
989 the total number of bytes physically written to the server
990 (`write'). Data transfer is subdivided in the number of bytes
991 read via normal read() system calls (`nread'), the number of bytes
992 written via normal read() system calls (`nwrit'), the number of
993 bytes read via direct I/O (`dread'), the number of bytes written
994 via direct I/O (`dwrit'), the number of bytes read via memory
995 mapped I/O pages (`mread'), and the number of bytes written via
996 memory mapped I/O pages (`mwrit').
997 NFC Network Filesystem (NFS) client side counters.
999 This line contains the number of RPC calls issues by local pro‐
1000 cesses (`rpc'), the number of read RPC calls (`read`) and write
1001 RPC calls (`rpwrite') issued to the NFS server, the number of RPC
1002 calls being retransmitted (`retxmit') and the number of authoriza‐
1003 tion refreshes (`autref').
1004 NFS Network Filesystem (NFS) server side counters.
1006 This line contains the number of RPC calls received from NFS
1007 clients (`rpc'), the number of read RPC calls received (`cread`),
1008 the number of write RPC calls received (`cwrit'), the number of
1009 Megabytes/second returned to read requests by clients (`MBcr/s`),
1010 the number of Megabytes/second passed in write requests by clients
1011 (`MBcw/s`), the number of network requests handled via TCP
1012 (`nettcp'), the number of network requests handled via UDP (`ne‐
1013 tudp'), the number of reply cache hits (`rchits'), the number of
1014 reply cache misses (`rcmiss') and the number of uncached requests
1015 (`rcnoca'). Furthermore some error counters indicating the number
1016 of requests with a bad format (`badfmt') or a bad authorization
1017 (`badaut'), and a counter indicating the number of bad clients
1018 (`badcln').
1019 NET Network utilization (TCP/IP).
1021 One line is shown for activity of the transport layer (TCP and
1022 UDP), one line for the IP layer and one line per active interface.
1023 For the transport layer, counters are shown concerning the number
1024 of received TCP segments including those received in error
1025 (`tcpi'), the number of transmitted TCP segments excluding those
1026 containing only retransmitted octets (`tcpo'), the number of UDP
1027 datagrams received (`udpi'), the number of UDP datagrams transmit‐
1028 ted (`udpo'), the number of active TCP opens (`tcpao'), the number
1029 of passive TCP opens (`tcppo'), the number of TCP output retrans‐
1030 missions (`tcprs'), the number of TCP input errors (`tcpie'), the
1031 number of TCP output resets (`tcpor'), the number of UDP no ports
1032 (`udpnp'), and the number of UDP input errors (`udpie').
1033 If the screen-width does not allow all of these counters, only a
1034 relevant subset is shown.
1035 These counters are related to IPv4 and IPv6 combined.
1036 For the IP layer, counters are shown concerning the number of IP
1038 datagrams received from interfaces, including those received in
1039 error (`ipi'), the number of IP datagrams that local higher-layer
1040 protocols offered for transmission (`ipo'), the number of received
1041 IP datagrams which were forwarded to other interfaces (`ipfrw'),
1042 the number of IP datagrams which were delivered to local higher-
1043 layer protocols (`deliv'), the number of received ICMP datagrams
1044 (`icmpi'), and the number of transmitted ICMP datagrams (`icmpo').
1045 If the screen-width does not allow all of these counters, only a
1046 relevant subset is shown.
1047 These counters are related to IPv4 and IPv6 combined.
1048 For every active network interface one line is shown, sorted on
1050 the interface activity. Such line shows the name of the interface
1051 and its busy percentage in the first column. The busy percentage
1052 for half duplex is determined by comparing the interface speed
1053 with the number of bits transmitted and received per second; for
1054 full duplex the interface speed is compared with the highest of
1055 either the transmitted or the received bits. When the interface
1056 speed can not be determined (e.g. for the loopback interface),
1057 `---' is shown instead of the percentage.
1058 Furthermore the number of received packets (`pcki'), the number of
1059 transmitted packets (`pcko'), the line speed of the interface
1060 (`sp'), the effective amount of bits received per second (`si'),
1061 the effective amount of bits transmitted per second (`so'), the
1062 number of collisions (`coll'), the number of received multicast
1063 packets (`mlti'), the number of errors while receiving a packet
1064 (`erri'), the number of errors while transmitting a packet
1065 (`erro'), the number of received packets dropped (`drpi'), and the
1066 number of transmitted packets dropped (`drpo').
1067 If the screen-width does not allow all of these counters, only a
1068 relevant subset is shown.
1069 The number of lines showing the network interfaces can be limited.
1070 IFB Infiniband utilization.
1072 For every active Infiniband port one line is shown, sorted on ac‐
1073 tivity. Such line shows the name of the port and its busy per‐
1074 centage in the first column. The busy percentage is determined by
1075 taking the highest of either the transmitted or the received bits
1076 during the interval, multiplying that value by the number of lanes
1077 and comparing it against the maximum port speed.
1078 Furthermore the number of received packets divided by the number
1079 of lanes (`pcki'), the number of transmitted packets divided by
1080 the number of lanes (`pcko'), the maximum line speed (`sp'), the
1081 effective amount of bits received per second (`si'), the effective
1082 amount of bits transmitted per second (`so'), and the number of
1083 lanes (`lanes').
1084 If the screen-width does not allow all of these counters, only a
1085 relevant subset is shown.
1086 The number of lines showing the Infiniband ports can be limited.
1087
1089 Following the system level information, the processes are shown from
1090 which the resource utilization has changed during the last interval.
1091 These processes might have used cpu time or issued disk or network re‐
1092 quests. However a process is also shown if part of it has been paged
1093 out due to lack of memory (while the process itself was in sleep
1094 state).
1095 Per process the following fields may be shown (in alphabetical order),
1097 depending on the current output mode as described in the section INTER‐
1098 ACTIVE COMMANDS and depending on the current width of your window:
1099 AVGRSZ The average size of one read-action on disk.
1101 AVGWSZ The average size of one write-action on disk.
1103 BANDWI Total bandwidth for received TCP and UDP packets consumed by
1105 this process (bits-per-second). This value can be compared
1106 with the value `si' on interface level (used bandwidth per in‐
1107 terface).
1108 This information will only be shown when the kernel module
1109 `netatop' is loaded.
1110 BANDWO Total bandwidth for sent TCP and UDP packets consumed by this
1112 process (bits-per-second). This value can be compared with
1113 the value `so' on interface level (used bandwidth per inter‐
1114 face).
1115 This information will only be shown when the kernel module
1116 `netatop' is loaded.
1117 BDELAY Aggregated block I/O delay, i.e. time waiting for disk I/O.
1119 CGROUP Path name of the cgroup (version 2) to which this process be‐
1121 longs. This path name is relative to the cgroup root direc‐
1122 tory, which is usually `/sys/fs/cgroup'.
1123 CID Container ID (Docker) of 12 hexadecimal digits, referring to
1125 the container in which the process/thread is running. If a
1126 process has been started and finished during the last inter‐
1127 val, a `?' is shown because the container ID is not part of
1128 the standard process accounting record.
1129 CMD The name of the process. This name can be surrounded by
1131 "less/greater than" signs (`<name>') which means that the
1132 process has finished during the last interval.
1133 Behind the abbreviation `CMD' in the header line, the current
1134 page number and the total number of pages of the
1135 process/thread list are shown.
1136 COMMAND-LINE
1138 The full command line of the process (including arguments). If
1139 the length of the command line exceeds the length of the
1140 screen line, the arrow keys -> and <- can be used for horizon‐
1141 tal scroll.
1142 Behind the verb `COMMAND-LINE' in the header line, the current
1143 page number and the total number of pages of the
1144 process/thread list are shown.
1145 CPU The occupation percentage of this process related to the
1147 available capacity for this resource on system level.
1148 CPUMAX The `cpu.max' value of the cgroup (version 2) to which this
1150 process belongs, calculated as percentage of one CPU.
1151 CPUMAXR The most restrictive (i.e. effective) `cpu.max' value defined
1153 by the upper directories of the cgroup (version 2) to which
1154 this process belongs, calculated as percentage of one CPU.
1155 CPUNR The identification of the CPU the (main) thread is running on
1157 or has recently been running on.
1158 CPUWGT The `cpu.weight' value of the cgroup (version 2) to which this
1160 process belongs.
1161 CTID Container ID (OpenVZ). If a process has been started and fin‐
1163 ished during the last interval, a `?' is shown because the
1164 container ID is not part of the standard process accounting
1165 record.
1166 DSK The occupation percentage of this process related to the total
1168 load that is produced by all processes (i.e. total disk ac‐
1169 cesses by all processes during the last interval).
1170 This information is shown when per process "storage account‐
1171 ing" is active in the kernel.
1172 EGID Effective group-id under which this process executes.
1174 ENDATE Date that the process has been finished. If the process is
1176 still running, this field shows `active'.
1177 ENTIME Time that the process has been finished. If the process is
1179 still running, this field shows `active'.
1180 ENVID Virtual environment identified (OpenVZ only).
1182 EUID Effective user-id under which this process executes.
1184 EXC The exit code of a terminated process (second position of col‐
1186 umn `ST' is E) or the fatal signal number (second position of
1187 column `ST' is S or C).
1188 FSGID Filesystem group-id under which this process executes.
1190 FSUID Filesystem user-id under which this process executes.
1192 GPU When the atopgpud daemon does not run with root privileges,
1194 the GPU percentage reflects the GPU memory occupation percent‐
1195 age (memory of all GPUs is 100%).
1196 When the atopgpud daemon runs with root privileges, the GPU
1197 percentage reflects the GPU busy percentage.
1198 GPUBUSY Busy percentage on all GPUs (one GPU is 100%).
1200 When the atopgpud daemon does not run with root privileges,
1201 this value is not available.
1202 GPUNUMS Comma-separated list of GPUs used by the process during the
1204 interval. When the comma-separated list exceeds the width of
1205 the column, a hexadecimal value is shown.
1206 LOCKSZ The virtual amount of memory being locked (i.e. non-swappable)
1208 by this process (or user).
1209 MAJFLT The number of page faults issued by this process that have
1211 been solved by creating/loading the requested memory page.
1212 MEM The occupation percentage of this process related to the
1214 available capacity for this resource on system level.
1215 MEMAVG Average memory occupation during the interval on all used
1217 GPUs.
1218 MEMBUSY Busy percentage of memory on all GPUs (one GPU is 100%), i.e.
1220 the time needed for read and write accesses on memory.
1221 When the atopgpud daemon does not run with root privileges,
1222 this value is not available.
1223 MEMMAX The `memory.max' value of the cgroup (version 2) to which this
1225 process belongs.
1226 MEMNOW Memory occupation at the moment of the sample on all used
1228 GPUs.
1229 MMMAXR The most restrictive (i.e. effective) `memory.max' value de‐
1231 fined by the upper directories of the cgroup (version 2) to
1232 which this process belongs.
1233 MINFLT The number of page faults issued by this process that have
1235 been solved by reclaiming the requested memory page from the
1236 free list of pages.
1237 NET The occupation percentage of this process related to the total
1239 load that is produced by all processes (i.e. consumed network
1240 bandwidth of all processes during the last interval).
1241 This information will only be shown when kernel module `ne‐
1242 tatop' is loaded.
1243 NICE The more or less static priority that can be given to a
1245 process on a scale from -20 (high priority) to +19 (low prior‐
1246 ity).
1247 NPROCS The number of active and terminated processes accumulated for
1249 this user or program.
1250 PID Process-id. If a process has been started and finished during
1252 the last interval, a `?' is shown because the process-id is
1253 not part of the standard process accounting record.
1254 POLI The policies 'norm' (normal, which is SCHED_OTHER), 'btch'
1256 (batch) and 'idle' refer to timesharing processes. The poli‐
1257 cies 'fifo' (SCHED_FIFO) and 'rr' (round robin, which is
1258 SCHED_RR) refer to realtime processes.
1259 PPID Parent process-id. If a process has been started and finished
1261 during the last interval, value 0 is shown because the parent
1262 process-id is not part of the standard process accounting
1263 record.
1264 PRI The process' priority ranges from 0 (highest priority) to 139
1266 (lowest priority). Priority 0 to 99 are used for realtime pro‐
1267 cesses (fixed priority independent of their behavior) and pri‐
1268 ority 100 to 139 for timesharing processes (variable priority
1269 depending on their recent CPU consumption and the nice value).
1270 PSIZE The proportional memory size of this process (or user).
1272 Every process shares resident memory with other processes.
1273 E.g. when a particular program is started several times, the
1274 code pages (text) are only loaded once in memory and shared by
1275 all incarnations. Also the code of shared libraries is shared
1276 by all processes using that shared library, as well as shared
1277 memory and memory-mapped files. For the PSIZE calculation of
1278 a process, the resident memory of a process that is shared
1279 with other processes is divided by the number of sharers.
1280 This means, that every process is accounted for a proportional
1281 part of that memory. Accumulating the PSIZE values of all pro‐
1282 cesses in the system gives a reliable impression of the total
1283 resident memory consumed by all processes.
1284 Since gathering of all values that are needed to calculate the
1285 PSIZE is a very time-consuming task, the 'R' key (or '-R'
1286 flag) should be active. Gathering these values also requires
1287 superuser privileges (otherwise '?K' is shown in the output).
1288 If a process has finished during the last interval, no value
1289 is shown since the proportional memory size is not part of the
1290 standard process accounting record.
1291 RDDSK When the kernel maintains standard io statistics (>= 2.6.20):
1293 The read data transfer issued physically on disk (so reading
1294 from the disk cache is not accounted for).
1295 Unfortunately, the kernel aggregates the data transfer of a
1296 process to the data transfer of its parent process when termi‐
1297 nating, so you might see transfers for (parent) processes like
1298 cron, bash or init, that are not really issued by them.
1299 RDELAY Runqueue delay, i.e. time spent waiting on a runqueue.
1301 RGID The real group-id under which the process executes.
1303 RGROW The amount of resident memory that the process has grown dur‐
1305 ing the last interval. A resident growth can be caused by
1306 touching memory pages which were not physically created/loaded
1307 before (load-on-demand). Note that a resident growth can also
1308 be negative e.g. when part of the process is paged out due to
1309 lack of memory or when the process frees dynamically allocated
1310 memory. For a process which started during the last interval,
1311 the resident growth reflects the total resident size of the
1312 process at that moment.
1313 If a process has finished during the last interval, no value
1314 is shown since resident memory occupation is not part of the
1315 standard process accounting record.
1316 RNET The number of TCP- and UDP packets received by this process.
1318 This information will only be shown when kernel module `ne‐
1319 tatop' is installed.
1320 If a process has finished during the last interval, no value
1321 is shown since network counters are not part of the standard
1322 process accounting record.
1323 RSIZE The total resident memory usage consumed by this process (or
1325 user). Notice that the RSIZE of a process includes all resi‐
1326 dent memory used by that process, even if certain memory parts
1327 are shared with other processes (see also the explanation of
1328 PSIZE).
1329 If a process has finished during the last interval, no value
1330 is shown since resident memory occupation is not part of the
1331 standard process accounting record.
1332 RTPR Realtime priority according the POSIX standard. Value can be
1334 0 for a timesharing process (policy 'norm', 'btch' or 'idle')
1335 or ranges from 1 (lowest) till 99 (highest) for a realtime
1336 process (policy 'rr' or 'fifo').
1337 RUID The real user-id under which the process executes.
1339 S The current state of the (main) thread: `R' for running (cur‐
1341 rently processing or in the runqueue), `S' for sleeping inter‐
1342 ruptible (wait for an event to occur), `D' for sleeping non-
1343 interruptible, `Z' for zombie (waiting to be synchronized with
1344 its parent process), `T' for stopped (suspended or traced),
1345 `W' for swapping, and `E' (exit) for processes which have fin‐
1346 ished during the last interval.
1347 SGID The saved group-id of the process.
1349 SNET The number of TCP and UDP packets transmitted by this process.
1351 This information will only be shown when the kernel module
1352 `netatop' is loaded.
1353 ST The status of a process.
1355 The first position indicates if the process has been started
1356 during the last interval (the value N means 'new process').
1357 The second position indicates if the process has been finished
1359 during the last interval.
1360 The value E means 'exit' on the process' own initiative; the
1361 exit code is displayed in the column `EXC'.
1362 The value S means that the process has been terminated unvol‐
1363 untarily by a signal; the signal number is displayed in the in
1364 the column `EXC'.
1365 The value C means that the process has been terminated unvol‐
1366 untarily by a signal, producing a core dump in its current di‐
1367 rectory; the signal number is displayed in the column `EXC'.
1368 STDATE The start date of the process.
1370 STTIME The start time of the process.
1372 SUID The saved user-id of the process.
1374 SWPMAX The `memory.swap.max' value of the cgroup (version 2) to which
1376 this process belongs.
1377 SWAPSZ The swap space consumed by this process (or user).
1379 SWMAXR The most restrictive (i.e. effective) `memory.swap.max' value
1381 defined by the upper directories of the cgroup (version 2) to
1382 which this process belongs.
1383 SYSCPU CPU time consumption of this process in system mode (kernel
1385 mode), usually due to system call handling.
1386 TCPRASZ The average size of a received TCP buffer in bytes. This in‐
1388 formation will only be shown when the kernel module `netatop'
1389 is loaded.
1390 TCPRCV The number of TCP packets received for this process. This in‐
1392 formation will only be shown when the kernel module `netatop'
1393 is loaded.
1394 TCPSASZ The average size of a transmitted TCP buffer in bytes. This
1396 information will only be shown when the kernel module `ne‐
1397 tatop' is loaded.
1398 TCPSND The number of TCP packets transmitted for this process. This
1400 information will only be shown when the kernel module `ne‐
1401 tatop' is loaded.
1402 THR Total number of threads within this process. All related
1404 threads are contained in a thread group, represented by atop
1405 as one line or as a separate line when the 'y' key (or -y
1406 flag) is active.
1407 On Linux 2.4 systems it is hardly possible to determine which
1409 threads (i.e. processes) are related to the same thread group.
1410 Every thread is represented by atop as a separate line.
1411 TID Thread-id. All threads within a process run with the same PID
1413 but with a different TID. This value is shown for individual
1414 threads in multi-threaded processes (when using the key 'y').
1415 TRUN Number of threads within this process that are in the state
1417 'running' (R).
1418 TSLPI Number of threads within this process that are in the state
1420 'interruptible sleeping' (S).
1421 TSLPU Number of threads within this process that are in the state
1423 'uninterruptible sleeping' (D).
1424 UDPRASZ The average size of a received UDP packet in bytes. This in‐
1426 formation will only be shown when the kernel module `netatop'
1427 is loaded.
1428 UDPRCV The number of UDP packets received by this process. This in‐
1430 formation will only be shown when the kernel module `netatop'
1431 is loaded.
1432 UDPSASZ The average size of a transmitted UDP packets in bytes. This
1434 information will only be shown when the kernel module `ne‐
1435 tatop' is loaded.
1436 UDPSND The number of UDP packets transmitted by this process. This
1438 information will only be shown when the kernel module `ne‐
1439 tatop' is loaded.
1440 USRCPU CPU time consumption of this process in user mode, due to pro‐
1442 cessing the own program text.
1443 VDATA The virtual memory size of the private data used by this
1445 process (including heap and shared library data).
1446 VGROW The amount of virtual memory that the process has grown during
1448 the last interval. A virtual growth can be caused by e.g. is‐
1449 suing a malloc() or attaching a shared memory segment. Note
1450 that a virtual growth can also be negative by e.g. issuing a
1451 free() or detaching a shared memory segment. For a process
1452 which started during the last interval, the virtual growth re‐
1453 flects the total virtual size of the process at that moment.
1454 If a process has finished during the last interval, no value
1455 is shown since virtual memory occupation is not part of the
1456 standard process accounting record.
1457 VPID Virtual process-id (within an OpenVZ container). If a process
1459 has been started and finished during the last interval, a `?'
1460 is shown because the virtual process-id is not part of the
1461 standard process accounting record.
1462 VSIZE The total virtual memory usage consumed by this process (or
1464 user).
1465 If a process has finished during the last interval, no value
1466 is shown since virtual memory occupation is not part of the
1467 standard process accounting record.
1468 VSLIBS The virtual memory size of the (shared) text of all shared li‐
1470 braries used by this process.
1471 VSTACK The virtual memory size of the (private) stack used by this
1473 process
1474 VSTEXT The virtual memory size of the (shared) text of the executable
1476 program.
1477 WCHAN Wait channel of thread in sleep state, i.e. the name of the
1479 kernel function in which the thread has been put asleep.
1480 Since determining the name string of the kernel function is a
1481 relatively time-consuming task, the 'W' key (or '-W' flag)
1482 should be active.
1483 WRDSK When the kernel maintains standard io statistics (>= 2.6.20):
1485 The write data transfer issued physically on disk (so writing
1486 to the disk cache is not accounted for). This counter is
1487 maintained for the application process that writes its data to
1488 the cache (assuming that this data is physically transferred
1489 to disk later on). Notice that disk I/O needed for swapping is
1490 not taken into account.
1491 Unfortunately, the kernel aggregates the data transfer of a
1492 process to the data transfer of its parent process when termi‐
1493 nating, so you might see transfers for (parent) processes like
1494 cron, bash or init, that are not really issued by them.
1495 WCANCL When the kernel maintains standard io statistics (>= 2.6.20):
1497 The write data transfer previously accounted for this process
1498 or another process that has been cancelled. Suppose that a
1499 process writes new data to a file and that data is removed
1500 again before the cache buffers have been flushed to disk.
1501 Then the original process shows the written data as WRDSK,
1502 while the process that removes/truncates the file shows the
1503 unflushed removed data as WCANCL.
1504
1506 With the flag -P followed by a list of one or more labels (comma-sepa‐
1507 rated), parseable output is produced for each sample. The labels that
1508 can be specified for system-level statistics correspond to the labels
1509 (first verb of each line) that can be found in the interactive output:
1510 "CPU", "cpu", "CPL", "GPU", "MEM", "SWP", "PAG", "PSI", "LVM", "MDD",
1511 "DSK", "NFM", "NFC", "NFS", "NET", "IFB", "LLC", "NUM" and "NUC".
1512 For process-level statistics special labels are available: "PRG" (gen‐
1513 eral), "PRC" (cpu), "PRE" (GPU), "PRM" (memory), "PRD" (disk, only if
1514 "storage accounting" is active) and "PRN" (network, only if the kernel
1515 module 'netatop' has been installed).
1516 With the label "ALL", all system and process level statistics are
1517 shown.
1518 The command and command line in the parseable output might contain spa‐
1520 ces and are therefore by default surrounded by parenthesis. However,
1521 since a space is often used as separator between the fields by parsing
1522 tools, with the additional flag -Z it is possible to exchange the spa‐
1523 ces in the command (line) by underscores and omit the parenthesis.
1524 For every interval all requested lines are shown whereafter atop shows
1526 a line just containing the label "SEP" as a separator before the lines
1527 for the next sample are generated.
1528 When a sample contains the values since boot, atop shows a line just
1529 containing the label "RESET" before the lines for this sample are gen‐
1530 erated.
1531 The first part of each output-line consists of the following six
1533 fields: label (the name of the label), host (the name of this machine),
1534 epoch (the time of this interval as number of seconds since 1-1-1970),
1535 date (date of this interval in format YYYY/MM/DD), time (time of this
1536 interval in format HH:MM:SS), and interval (number of seconds elapsed
1537 for this interval).
1538 The subsequent fields of each output-line depend on the label:
1540 CPU Subsequent fields: total number of clock-ticks per second for
1542 this machine, number of processors, consumption for all CPUs
1543 in system mode (clock-ticks), consumption for all CPUs in user
1544 mode (clock-ticks), consumption for all CPUs in user mode for
1545 niced processes (clock-ticks), consumption for all CPUs in
1546 idle mode (clock-ticks), consumption for all CPUs in wait mode
1547 (clock-ticks), consumption for all CPUs in irq mode (clock-
1548 ticks), consumption for all CPUs in softirq mode (clock-
1549 ticks), consumption for all CPUs in steal mode (clock-ticks),
1550 consumption for all CPUs in guest mode (clock-ticks) overlap‐
1551 ping user mode, frequency of all CPUs, frequency percentage of
1552 all CPUs, instructions executed by all CPUs and cycles for all
1553 CPUs.
1554 cpu Subsequent fields: total number of clock-ticks per second for
1556 this machine, processor-number, consumption for this CPU in
1557 system mode (clock-ticks), consumption for this CPU in user
1558 mode (clock-ticks), consumption for this CPU in user mode for
1559 niced processes (clock-ticks), consumption for this CPU in
1560 idle mode (clock-ticks), consumption for this CPU in wait mode
1561 (clock-ticks), consumption for this CPU in irq mode (clock-
1562 ticks), consumption for this CPU in softirq mode (clock-
1563 ticks), consumption for this CPU in steal mode (clock-ticks),
1564 consumption for this CPU in guest mode (clock-ticks) overlap‐
1565 ping user mode, frequency of this CPU, frequency percentage of
1566 this CPU, instructions executed by this CPU and cycles for
1567 this CPU.
1568 CPL Subsequent fields: number of processors, load average for last
1570 minute, load average for last five minutes, load average for
1571 last fifteen minutes, number of context-switches, and number
1572 of device interrupts.
1573 GPU Subsequent fields: GPU number, bus-id string, type of GPU
1575 string, GPU busy percentage during last second (-1 if not
1576 available), memory busy percentage during last second (-1 if
1577 not available), total memory size (KiB), used memory (KiB) at
1578 this moment, number of samples taken during interval, cumula‐
1579 tive GPU busy percentage during the interval (to be divided by
1580 the number of samples for the average busy percentage, -1 if
1581 not available), cumulative memory busy percentage during the
1582 interval (to be divided by the number of samples for the aver‐
1583 age busy percentage, -1 if not available), and cumulative mem‐
1584 ory occupation during the interval (to be divided by the num‐
1585 ber of samples for the average occupation).
1586 MEM Subsequent fields: page size for this machine (in bytes), size
1588 of physical memory (pages), size of free memory (pages), size
1589 of page cache (pages), size of buffer cache (pages), size of
1590 slab (pages), dirty pages in cache (pages), reclaimable part
1591 of slab (pages), total size of vmware's balloon pages (pages),
1592 total size of shared memory (pages), size of resident shared
1593 memory (pages), size of swapped shared memory (pages), huge
1594 page size (in bytes), total size of huge pages (huge pages),
1595 size of free huge pages (huge pages), size of ARC (cache) of
1596 ZFSonlinux (pages), size of sharing pages for KSM (pages),
1597 size of shared pages for KSM (pages), size of memory used for
1598 TCP sockets (pages), size of memory used for UDP sockets
1599 (pages), and size of pagetables (pages).
1600 SWP Subsequent fields: page size for this machine (in bytes), size
1602 of swap (pages), size of free swap (pages), size of swap cache
1603 (pages), size of committed space (pages), limit for committed
1604 space (pages), size of the swap cache (pages), size of com‐
1605 pressed pages stored in zswap (pages), and total size of com‐
1606 pressed pool in zswap (pages).
1607 LLC Subsequent fields: LLC id, percentage of LLC in use, total
1609 memory bandwidth of this LLC (in bytes), and memory bandwidth
1610 on local NUMA node of this LLC (in bytes).
1611 PAG Subsequent fields: page size for this machine (in bytes), num‐
1613 ber of page scans, number of allocstalls, 0 (future use), num‐
1614 ber of swapins, number of swapouts, number of oomkills (-1
1615 when counter not present), number of process stalls to run
1616 memory compaction, number of pages successfully migrated in
1617 total, number of NUMA pages migrated, number of pages read
1618 from block devices, and number of pages written to block de‐
1619 vices.
1620 PSI Subsequent fields: PSI statistics present on this system (n or
1622 y), CPU some avg10, CPU some avg60, CPU some avg300, CPU some
1623 accumulated microseconds during interval, memory some avg10,
1624 memory some avg60, memory some avg300, memory some accumulated
1625 microseconds during interval, memory full avg10, memory full
1626 avg60, memory full avg300, memory full accumulated microsec‐
1627 onds during interval, I/O some avg10, I/O some avg60, I/O some
1628 avg300, I/O some accumulated microseconds during interval, I/O
1629 full avg10, I/O full avg60, I/O full avg300, and I/O full ac‐
1630 cumulated microseconds during interval.
1631 LVM/MDD/DSK
1633 For every logical volume/multiple device/hard disk one line is
1634 shown.
1635 Subsequent fields: name, number of milliseconds spent for I/O,
1636 number of reads issued, number of sectors transferred for
1637 reads, number of writes issued, number of sectors transferred
1638 for write, number of discards issued (-1 if not supported),
1639 number of sectors transferred for discards, number of requests
1640 currently in flight (not yet completed), and the average queue
1641 depth while the disk was busy.
1642 NFM Subsequent fields: mounted NFS filesystem, total number of
1644 bytes read, total number of bytes written, number of bytes
1645 read by normal system calls, number of bytes written by normal
1646 system calls, number of bytes read by direct I/O, number of
1647 bytes written by direct I/O, number of pages read by memory-
1648 mapped I/O, and number of pages written by memory-mapped I/O.
1649 NFC Subsequent fields: number of transmitted RPCs, number of
1651 transmitted read RPCs, number of transmitted write RPCs, num‐
1652 ber of RPC retransmissions, and number of authorization re‐
1653 freshes.
1654 NFS Subsequent fields: number of handled RPCs, number of received
1656 read RPCs, number of received write RPCs, number of bytes read
1657 by clients, number of bytes written by clients, number of RPCs
1658 with bad format, number of RPCs with bad authorization, number
1659 of RPCs from bad client, total number of handled network re‐
1660 quests, number of handled network requests via TCP, number of
1661 handled network requests via UDP, number of handled TCP con‐
1662 nections, number of hits on reply cache, number of misses on
1663 reply cache, and number of uncached requests.
1664 NET First, one line is produced for the upper layers of the TCP/IP
1666 stack.
1667 Subsequent fields: the verb "upper", number of packets re‐
1668 ceived by TCP, number of packets transmitted by TCP, number of
1669 packets received by UDP, number of packets transmitted by UDP,
1670 number of packets received by IP, number of packets transmit‐
1671 ted by IP, number of packets delivered to higher layers by IP,
1672 number of packets forwarded by IP, number of input errors
1673 (UDP), number of noport errors (UDP), number of active opens
1674 (TCP), number of passive opens (TCP), number of passive opens
1675 (TCP), number of established connections at this moment (TCP),
1676 number of retransmitted segments (TCP), number of input errors
1677 (TCP), and number of output resets (TCP).
1678 Next, one line is shown for every interface.
1680 Subsequent fields: name of the interface, number of packets
1681 received by the interface, number of bytes received by the in‐
1682 terface, number of packets transmitted by the interface, num‐
1683 ber of bytes transmitted by the interface, interface speed,
1684 and duplex mode (0=half, 1=full).
1685 IFB Subsequent fields: name of the InfiniBand interface, port num‐
1687 ber, number of lanes, maximum rate (Mbps), number of bytes re‐
1688 ceived, number of bytes transmitted, number of packets re‐
1689 ceived, and number of packets transmitted.
1690 NUM Subsequent fields: NUMA node number, page size for this ma‐
1692 chine (in bytes), the fragmentation percentage of this node,
1693 size of physical memory (pages), size of free memory (pages),
1694 recently (active) used memory (pages), less recently (inac‐
1695 tive) used memory (pages), size of cached file data (pages),
1696 dirty pages in cache (pages), slab memory being used for ker‐
1697 nel mallocs (pages), slab memory that is reclaimable (pages),
1698 shared memory including tmpfs (pages), and total huge pages
1699 (pages).
1700 NUC Subsequent fields: NUMA node number, number of processors for
1702 this node, consumption for node CPUs in system mode (clock-
1703 ticks), consumption for node CPUs in user mode (clock-ticks),
1704 consumption for node CPUs in user mode for niced processes
1705 (clock-ticks), consumption for node CPUs in idle mode (clock-
1706 ticks), consumption for node CPUs in wait mode (clock-ticks),
1707 consumption for node CPUs in irq mode (clock-ticks), consump‐
1708 tion for node CPUs in softirq mode (clock-ticks), consumption
1709 for node CPUs in steal mode (clock-ticks), and consumption for
1710 node CPUs in guest mode (clock-ticks) overlapping user mode.
1711 PRG For every process one line is shown.
1713 Subsequent fields: PID (unique ID of task), name (between
1714 parenthesis or underscores for spaces), state, real uid, real
1715 gid, TGID (group number of related tasks/threads), total num‐
1716 ber of threads, exit code (in case of fatal signal: signal
1717 number + 256), start time (epoch), full command line (between
1718 parenthesis or underscores for spaces), PPID, number of
1719 threads in state 'running' (R), number of threads in state
1720 'interruptible sleeping' (S), number of threads in state 'un‐
1721 interruptible sleeping' (D), effective uid, effective gid,
1722 saved uid, saved gid, filesystem uid, filesystem gid, elapsed
1723 time of terminated process (hertz), is_process (y/n), OpenVZ
1724 virtual pid (VPID), OpenVZ container id (CTID), Docker con‐
1725 tainer id (CID), indication if the task is newly started dur‐
1726 ing this interval ('N'), and cgroup v2 path name (between
1727 parenthesis or underscores for spaces).
1728 PRC For every process one line is shown.
1730 Subsequent fields: PID, name (between parenthesis or under‐
1731 scores for spaces), state, total number of clock-ticks per
1732 second for this machine, CPU-consumption in user mode (clock‐
1733 ticks), CPU-consumption in system mode (clockticks), nice
1734 value, priority, realtime priority, scheduling policy, current
1735 CPU (-1 for exited process), sleep average, TGID (group number
1736 of related tasks/threads), is_process (y/n), runqueue delay in
1737 nanoseconds for this thread or for all threads (in case of
1738 process), wait channel of this thread (between parenthesis or
1739 underscores for spaces), block I/O delay (clockticks), cgroup
1740 v2 `cpu.max' calculated as percentage (-3 means no cgroup v2
1741 support, -2 means undefined and -1 means maximum), and cgroup
1742 v2 most restrictive `cpu.max' in upper directories calculated
1743 as percentage (-3 means no cgroup v2 support, -2 means unde‐
1744 fined and -1 means maximum).
1745 PRE For every process one line is shown.
1747 Subsequent fields: PID, name (between parenthesis or under‐
1748 scores for spaces), process state, GPU state (A for active, E
1749 for exited, N for no GPU user), number of GPUs used by this
1750 process, bitlist reflecting used GPUs, GPU busy percentage
1751 during interval, memory busy percentage during interval, mem‐
1752 ory occupation (KiB) at this moment cumulative memory occupa‐
1753 tion (KiB) during interval, and number of samples taken during
1754 interval.
1755 PRM For every process one line is shown.
1757 Subsequent fields: PID, name (between parenthesis or under‐
1758 scores for spaces), state, page size for this machine (in
1759 bytes), virtual memory size (KiB), resident memory size (KiB),
1760 shared text memory size (KiB), virtual memory growth (KiB),
1761 resident memory growth (KiB), number of minor page faults,
1762 number of major page faults, virtual library exec size (KiB),
1763 virtual data size (KiB), virtual stack size (KiB), swap space
1764 used (KiB), TGID (group number of related tasks/threads),
1765 is_process (y/n), proportional set size (KiB) if in 'R' option
1766 is specified, virtually locked memory space (KiB), cgroup v2
1767 `memory.max' in KiB (-3 means no cgroup v2 support, -2 means
1768 undefined and -1 means maximum), cgroup v2 most restrictive
1769 `memory.max' in upper directories in KiB (-3 means no cgroup
1770 v2 support, -2 means undefined and -1 means maximum), cgroup
1771 v2 `memory.swap.max' in KiB (-3 means no cgroup v2 support, -2
1772 means undefined and -1 means maximum), and cgroup v2 most re‐
1773 strictive `memory.swap.max' in upper directories in KiB (-3
1774 means no cgroup v2 support, -2 means undefined and -1 means
1775 maximum).
1776 PRD For every process one line is shown.
1778 Subsequent fields: PID, name (between parenthesis or under‐
1779 scores for spaces), state, obsoleted kernel patch installed
1780 ('n'), standard io statistics used ('y' or 'n'), number of
1781 reads on disk, cumulative number of sectors read, number of
1782 writes on disk, cumulative number of sectors written, can‐
1783 celled number of written sectors, TGID (group number of re‐
1784 lated tasks/threads), obsoleted value ('n'), and is_process
1785 (y/n).
1786 If the standard I/O statistics (>= 2.6.20) are not used, the
1787 disk I/O counters per process are not relevant. The counters
1788 'number of reads on disk' and 'number of writes on disk' are
1789 obsoleted anyhow.
1790 PRN For every process one line is shown.
1792 Subsequent fields: PID, name (between parenthesis or under‐
1793 scores for spaces), state, kernel module 'netatop' loaded ('y'
1794 or 'n'), number of TCP-packets transmitted, cumulative size of
1795 TCP-packets transmitted, number of TCP-packets received, cumu‐
1796 lative size of TCP-packets received, number of UDP-packets
1797 transmitted, cumulative size of UDP-packets transmitted, num‐
1798 ber of UDP-packets received, cumulative size of UDP-packets
1799 transmitted, number of raw packets transmitted (obsolete, al‐
1800 ways 0), number of raw packets received (obsolete, always 0),
1801 TGID (group number of related tasks/threads) and is_process
1802 (y/n).
1803 If the kernel module is not active, the network I/O counters
1804 per process are not relevant.
1805
1807 With the flag -J followed by a list of one or more labels (comma-sepa‐
1808 rated), JSON output is produced for each sample. The syntax and name
1809 of JSON labels are the same as for the parseable output.
1810
1812 By sending the SIGUSR1 signal to atop a new sample will be forced, even
1813 if the current timer interval has not exceeded yet. The behavior is
1814 similar to pressing the `t` key in an interactive session.
1815 By sending the SIGUSR2 signal to atop a final sample will be forced af‐
1817 ter which atop will terminate.
1818
1820 To monitor the current system load interactively with an interval of 5
1821 seconds:
1822 atop 5
1824 To monitor the system load and write it to a file (in plain ASCII) with
1826 an interval of one minute during half an hour with active processes
1827 sorted on memory consumption:
1828 atop -M 60 30 > /log/atop.mem
1830 Store information about the system and process activity in binary com‐
1832 pressed form to a file with an interval of ten minutes during an hour:
1833 atop -w /tmp/atop.raw 600 6
1835 View the contents of this file interactively:
1837 atop -r /tmp/atop.raw
1839 View the processor and disk utilization of this file in parseable for‐
1841 mat:
1842 atop -PCPU,DSK -r /tmp/atop.raw
1844 View the contents of today's standard logfile interactively:
1846 atop -r
1848 View the contents of the standard logfile of the day before yesterday
1850 interactively:
1851 atop -r yy
1853 View the contents of the standard logfile of 2014, June 7 from 02:00 PM
1855 onwards interactively:
1856 atop -r 20140607 -b 1400
1858 Concatenate all raw log files of January 2020 and generate parsable
1860 output about the CPU utilization:
1861 atopcat /var/log/atop/atop_202001?? | atop -r - -PCPU
1863
1865 /var/run/pacct_shadow.d/
1866 Directory containing the process accounting shadow files that are
1867 used by atop when the atopacctd daemon is active.
1868 /var/cache/atop.d/atop.acct
1870 File in which the kernel writes the accounting records when atop
1871 itself has activated the process accounting mechanism.
1872 /etc/atoprc
1874 Configuration file containing system-wide default values. See re‐
1875 lated man-page.
1876 ~/.atoprc
1878 Configuration file containing personal default values. See re‐
1879 lated man-page.
1880 /etc/default/atop
1882 Configuration file to overrule the settings of atop that runs in
1883 the background to create the daily logfile. This file is created
1884 when atop is installed. The default settings are:
1885 LOGOPTS=""
1887 LOGINTERVAL=600
1888 LOGGENERATIONS=28
1889 /var/log/atop/atop_YYYYMMDD
1891 Raw file, where YYYYMMDD are digits representing the current date.
1892 This name is used by atop running in the background as default
1893 name for the output file, and by atop as default name for the in‐
1894 put file when using the -r flag.
1895 All binary system and process level data in this file has been
1896 stored in compressed format.
1897 /var/run/netatop.log
1899 File that contains the netpertask structs containing the network
1900 counters of exited processes. These structs are written by the ne‐
1901 tatopd daemon and read by atop after reading the standard process
1902 accounting records.
1903
1905 atopsar(1), atopconvert(1), atopcat(1), atoprc(5), atopacctd(8), ne‐
1906 tatop(4), netatopd(8), atopgpud(8), logrotate(8)
1907 https://www.atoptool.nl
1908
1910 Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
1911 JC van Winkel
1912Linux December 2022 ATOP(1)