1ATOP(1) General Commands Manual ATOP(1)
2
6 atop - Advanced System & Process Monitor
7
10 Live measurement in bar graph mode:
11 atop -B[H] [interval [samples]]
13 Live measurement in text mode:
15 atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-fFG1xR]
17 [interval [samples]]
18 Live generation of parsable output (white-space separated or JSON):
20 atop [-Plabel[,label]... [-Z]] [-Jlabel[,label]...] [interval [sam‐
22 ples]]
23 Write raw log files:
25 atop -w rawfile [-a] [-S] [interval [samples]]
27 Analyze raw log files in bar graph mode:
29 atop -B[H]r [rawfile|yyy...] [-b [YYYYMMDD]hhmm] [-e [YYYYMMDD]hhmm]
31 Analyze raw log files in text mode:
33 atop -r [rawfile|yyy...] [-b [YYYYMMDD]hhmm] [-e [YYYYMMDD]hhmm]
35 [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-fFG1xR]
36 Generate parsable output from raw log files (white-space separated or
38 JSON):
39 atop -r [rawfile|yyy...] [-b [YYYYMMDD]hhmm] [-e [YYYYMMDD]hhmm]
41 [-Plabel[,label]... [-Z]] [-Jlabel[,label]...]
42
45 The program atop is an interactive monitor to view the load on a Linux
46 system. Every interval seconds (default: 10 seconds) information is
47 gathered about the resource occupation on system level of the most
48 critical hardware resources (from a performance point of view), i.e.
49 CPUs, memory, disks and network interfaces. Besides, information is
50 gathered about the processes (or threads) that are responsible for the
51 utilization of the CPUs, memory and disks. Network load per process is
52 shown only when the netatop kernel module has been installed.
53
55 When running atop you can choose to view the system load in bar graph
56 mode or in text mode. In bar graph mode the resource utilization of
57 CPUs, memory, disks and network interfaces is shown via (character-
58 based) bar graphs, but only on system level. When you want to view
59 more detailed information on system level or when you want to view the
60 resource consumption on process or thread level, you can switch to text
61 mode by pressing the 'B' key. Alternatively, you can use the 'B' key
62 (again) to switch from text mode to bar graph mode.
63 By default, atop starts in text mode unless the -B flag is used or un‐
64 less 'B' has been configured as a default flag in the .atoprc file (for
65 further information about default flags, refer to the atoprc man page).
66 In bar graph mode the terminal will be subdivided into four character-
68 based windows, i.e. one window for each hardware resource:
69 Processors
71 The first bar shows the average busy percentage of all CPUs with
72 the bar label 'Avg' (might be abbreviated to 'Av' or even just
73 'A'). The subsequent bars show the busy percentages of single
74 CPUs.
75 When there is not enough horizontal space to show all CPUs, only
76 the most busy CPUs per sample will be shown after the width of
77 each bar has been reduced to a minimum.
78 By default, the categories of CPU consumption are shown by differ‐
80 ent colors in the bars, marked with a character 'S' (system mode),
81 'U' (user mode), 'I' (interrupt handling), 's' (steal) and 'G'
82 (guest, i.e. consumed by virtual machines).
83 The top of the bar might consist of an unmarked color representing
84 a 'neutral' category. Suppose that the scale unit is 5% per line
85 and the total busy percentage is 54% consisting of two categories
86 of 27%. The two categories will be rounded to 25% (5 lines of 5%
87 each) but the total busy percentage will be rounded to 55% (11
88 lines of 5%). Then the top line will represent a 'neutral' cate‐
89 gory.
90 By pressing the 'H' key or by starting atop with the '-H' flag, no
91 categories are shown.
92 A red line is drawn in the bar graph as critical threshold. By
94 default this value is 90% and can be modified by the 'cpucritperc'
95 option in the configuration file (see separate atoprc man page).
96 When this value is set to zero, no threshold line will be drawn.
97 Memory and swap space
99 Memory is presented as a column in which the specific categories
100 of memory consumption are shown. These categories are (code, data
101 and stack of) processes/kernel, slab caches (i.e. dynamically al‐
102 located kernel memory), shared memory, tmpfs, page cache and free
103 memory.
104 Swap space (if present) is also presented as a column in which the
105 categories processes/tmpfs, shared memory and free space are
106 shown.
107 At the right side memory-related event counters are shown.
109 The bottom three counters are colored green when there is no mem‐
110 ory pressure. When considerable activity is noticed such counter
111 might be colored orange and with high activity red.
112 When memory pressure starts, usually memory page scanning will be
113 activated first. When pressure increases, memory pages of pro‐
114 cesses might be swapped out to swap space (if present).
115 The 'oomkills' counter (Out Of Memory killing) is most serious: it
116 reflects the number of processes that are killed due to lack of
117 memory (and swap). Therefore this counter shows the absolute num‐
118 ber (not per second) of processes being killed during the last in‐
119 terval and will immediately be colored red when it is 1 or more.
120 Besides, after atop has noticed OOM killing the 'oomkills' counter
121 remains orange for the next 15 minutes, just in case that you have
122 missed the OOM killing event itself.
123 When there is enough vertical space in the memory window, event
124 counters are shown about the number of memory pages being swapped
125 in, the number of memory pages paged out to block devices and the
126 number of memory pages paged in from block devices.
127 Memory and swap space consumption will preferably be shown in a
129 character-based window that vertically uses the entire screen for
130 optimal granularity. However, when there are a lot of disks and/or
131 network interfaces the memory and swap space consumption will be
132 shown in a character-based window that only uses the upper half of
133 the screen.
134 Disks
136 For each disk the busy percentage is shown as a bar.
137 When there is not enough horizontal space to show all disks, only
138 the most busy disks per sample will be shown.
139 By default, categories of disk consumption are shown by different
141 colors in the bars, marked with a character 'R' (read) and 'W'
142 (write).
143 The top of the bar might consist of an unmarked color representing
144 a 'neutral' category. Suppose that the scale unit is 5% per line
145 and the total busy percentage is 54% consisting of two categories
146 of 27%. The two categories will be rounded to 25% (5 lines of 5%
147 each) but the total busy percentage will be rounded to 55% (11
148 lines of 5%). Then the top line will represent a 'neutral' cate‐
149 gory.
150 By pressing the 'H' key or by starting atop with the '-H' flag, no
151 categories are shown.
152 A red line is drawn in the bar graph as critical threshold. By
154 default this value is 90% and can be modified by the 'dskcritperc'
155 option in the configuration file (see separate atoprc man page).
156 When this value is set to zero, no threshold line will be drawn.
157 Interfaces
159 For each non-virtual network interface a double bar graph is shown
160 with a dedicated scale that reflects the traffic rate. One of the
161 bars shows the transmit rate ('TX') and the other bar the receive
162 rate ('RX'). The traffic scale of each network interface remains
163 at its highest level. All interface scales can be reset during
164 the measurement by pressing the 'L' key.
165 Most often the real speed (maximum bandwidth) of network inter‐
167 faces is not known, e.g. in case of the network interfaces of vir‐
168 tual machines. Therefore it is not possible to show the interface
169 utilization as a percentage. However, when the real speed of an
170 interface is known it will be shown underneath the concerning bar
171 graph.
172 When there is not enough horizontal space to show all network in‐
174 terfaces, only the most busy interfaces per sample will be shown.
175 Usually the bar graphs will not be sorted on busy percentage when there
177 is enough horizontal space. However, after switching from text mode to
178 bar graph mode the bar graphs might have been sorted because this was
179 needed for the presentation in text mode. The next interval in bar
180 graph mode shows the bars unsorted again unless the window width is un‐
181 sufficient for all bars.
182 The remaining part of this manual page mainly describes the information
184 shown in text mode. When certain descriptions also apply to bar graph
185 mode it will be mentioned explicitly.
186
189 The initial screen in text mode shows if atop runs with restricted view
190 (unprivileged user) or unrestricted view (privileged user). In case of
191 restricted view atop does not have the privileges (no root identity nor
192 the necessary capabilities) to retrieve all counter values on system
193 level and on process level.
194 With every interval information is shown about the resource occupation
196 on system level (CPU, memory, disks and network layers), followed by a
197 list of processes which have been active during the last interval. No‐
198 tice that all processes that were unchanged during the last interval
199 are not shown, unless the key 'a' has been pressed or unless sorting on
200 memory occupation is done (then inactive processes are relevant as
201 well). If the list of active processes does not entirely fit on the
202 screen, only the top of the list is shown (sorted in order of activ‐
203 ity).
204 The intervals are repeated till the number of samples (specified as
205 command argument) is reached, or till the key 'q' is pressed in inter‐
206 active mode.
207 When atop is started, it checks whether the standard output channel is
209 connected to a screen, or to a file/pipe. In the first case it produces
210 screen control codes (via the ncurses library) and behaves interac‐
211 tively; in the second case it produces flat text output.
212 In interactive mode, the output of atop scales dynamically to the cur‐
214 rent dimensions of the screen/window.
215 If the window is resized horizontally, columns will be added or removed
216 automatically. For this purpose, every column has a particular weight.
217 The columns with the highest weights that fit within the current width
218 will be shown.
219 If the window is resized vertically, lines of the process/thread list
220 will be added or removed automatically.
221 In interactive mode the output of atop can be controlled by pressing
223 particular keys. However it is also possible to specify such key as
224 flag on the command line. In that case atop switches to the indicated
225 mode on beforehand. This mode can be modified again interactively.
226 Specifying such key as flag is especially useful when running atop with
227 output to a pipe or file (non-interactively). These flags are the same
228 as the keys that can be pressed in interactive mode (see section INTER‐
229 ACTIVE COMMANDS).
230 Additional flags are available to support storage of atop-data in raw
231 format (see section RAW DATA STORAGE).
232
234 With every interval, atop reads the kernel administration to obtain in‐
235 formation about all running processes. However, it is likely that pro‐
236 cesses have terminated during the interval. These processes might have
237 consumed system resources during this interval before they terminated.
238 Therefore, atop tries to read the process accounting records that con‐
239 tain the accounting information of terminated processes and report
240 these processes too. Only when the process accounting mechanism in the
241 kernel is activated, the kernel writes such process accounting record
242 to a file for every process that terminates.
243 There are various ways for atop to get access to the process accounting
245 records (tried in this order):
246 1. When the environment variable ATOPACCT is set, it specifies the
248 name of the process accounting file. In that case, process ac‐
249 counting for this file should have been activated on beforehand.
250 Before opening this file for reading, atop drops its root privi‐
251 leges (if any).
252 When this environment variable is present but its contents is
253 empty, process accounting will not be used at all.
254 2. This is the preferred way of handling process accounting records!
256 When the atopacctd daemon is active, it has activated the process
257 accounting mechanism in the kernel and transfers to original ac‐
258 counting records to shadow files. In that case, atop drops its
259 root privileges and opens the current shadow file for reading.
260 This way is preferred, because the atopacctd daemon maintains full
261 control of the size of the original process accounting file written
262 by the kernel and the shadow files read by the atop process(es).
263 The atopacct service will be activated before the atop service to
265 enable atop to detect that process accounting is managed by the
266 atopacctd daemon. As a forking service, atopacctd takes care that
267 all directories and files are initialized before the parent process
268 dies. The child process continues as the daemon process.
269 For further information, refer to the atopacctd man page.
271 3. When the atopacctd daemon is not active, atop verifies if the
273 process accounting mechanism has been switched on via the separate
274 psacct or acct package (the package name depends on the Linux dis‐
275 tro). In that case, one of the files /var/log/pacct, /var/ac‐
276 count/pacct or /var/log/account/pacct is in use as process account‐
277 ing file and atop opens this file for reading.
278 4. As a last possibility, atop itself tries to activate the process
280 accounting mechanism (requires root privileges) using the file
281 /var/cache/atop.d/atop.acct (to be written by the kernel, to be
282 read by atop itself). Process accounting remains active as long as
283 at least one atop process is alive. Whenever the last atop process
284 stops (either by pressing 'q' or by 'kill -15'), it deactivates the
285 process accounting mechanism again. Therefore you should never ter‐
286 minate atop by 'kill -9', because then it has no chance to stop
287 process accounting. As a result, the accounting file may consume a
288 lot of disk space after a while.
289 To avoid that the process accounting file consumes too much disk
290 space, atop verifies at the end of every sample if the size of the
291 process accounting file exceeds 200 MiB and if this atop process is
292 the only one that is currently using the file. In that case the
293 file is truncated to a size of zero.
294 Notice that root-privileges are required to switch on/off process
296 accounting in the kernel. You can start atop as a root user or
297 specify setuid-root privileges to the executable file. In the lat‐
298 ter case, atop switches on process accounting and drops the root-
299 privileges again.
300 If atop does not run with root-privileges, it does not show infor‐
301 mation about finished processes. It indicates this situation with
302 the message 'no procacct' in the top-right corner (instead of the
303 counter that shows the number of exited processes).
304 When during one interval a lot of processes have finished, atop might
306 grow tremendously in memory when reading all process accounting records
307 at the end of the interval. To avoid such excessive growth atop will
308 never read more than 50 MiB with process information from the process
309 accounting file per interval (approx. 54000 finished processes). In
310 interactive mode a warning is given whenever processes have been
311 skipped for this reason.
312
314 For the resource consumption on system level, atop uses colors in text
315 mode to indicate that a critical occupation percentage has been (al‐
316 most) reached. A critical occupation percentage means that is likely
317 that this load causes a noticeable negative performance influence for
318 applications using this resource. The critical percentage depends on
319 the type of resource: e.g. the performance influence of a disk with a
320 busy percentage of 80% might be more noticeable for applications/users
321 than a CPU with a busy percentage of 90%.
322 Currently atop uses the following default values to calculate a
323 weighted percentage per resource:
324 Processor
326 A busy percentage of 90% or higher is considered 'critical' (also
327 in bar graph mode).
328 Disk
330 A busy percentage of 90% or higher is considered 'critical'.
331 Network
333 A busy percentage of 90% or higher for the load of an interface is
334 considered 'critical'.
335 Memory
337 An occupation percentage of 90% is considered 'critical'. Notice
338 that this occupation percentage is the accumulated memory consump‐
339 tion of the kernel (including slab) and all processes. The memory
340 for the page cache ('cache' and 'buff' in the MEM-line) and the
341 reclaimable part of the slab ('slrec') is not implied!
342 If the number of pages swapped out ('swout' in the PAG-line) is
343 larger than 10 per second, the memory resource is considered
344 'critical'. A value of at least 1 per second is considered 'al‐
345 most critical'.
346 If the committed virtual memory exceeds the limit ('vmcom' and
347 'vmlim' in the SWP-line), the SWP-line is colored due to overcom‐
348 mitting the system.
349 Swap
351 An occupation percentage of 80% is considered 'critical' because
352 swap space might be completely exhausted in the near future. It
353 is not critical from a performance point-of-view.
354 These default values can be modified in the configuration file (see
356 separate atoprc man page).
357 When a resource exceeds its critical occupation percentage, the con‐
359 cerning values in the screen line are colored red by default.
360 When a resource exceeds (by default) 80% of its critical percentage (so
361 it is almost critical), the concerning values in the screen line are
362 colored cyan by default. This 'almost critical percentage' (one value
363 for all resources) can be also modified in the configuration file (see
364 separate atoprc man page).
365 The default colors red and cyan can be modified in the configuration
366 file as well (see separate atoprc man page).
367 With the key 'x' (or flag -x), the use of colors can be suppressed in
369 text mode. The use of colors is however mandatory in case of bar graph
370 mode.
371
373 Per-process and per-thread network activity can be measured by the ne‐
374 tatop kernel module. You can download this kernel module from the web‐
375 site (mentioned at the end of this manual page) and install it on your
376 system.
377 When atop gathers counters for a new interval, it verifies if the ne‐
378 tatop module is currently active. If so, atop obtains the relevant net‐
379 work counters from this module and shows the number of sent and re‐
380 ceived packets per process/thread in the generic screen. Besides, de‐
381 tailed counters can be requested by pressing the 'n' key.
382 When the netatopd daemon is running as well, atop also reads the net‐
383 work counters of exited processes that are logged by this daemon (com‐
384 parable with process accounting).
385 More information about the optional netatop kernel module and the ne‐
387 tatopd daemon can be found in the concerning man-pages and on the web‐
388 site mentioned at the end of this manual page.
389
391 GPU statistics can be gathered by atopgpud which is a separate data
392 collection daemon process. It gathers cumulative utilization counters
393 of every Nvidia GPU in the system, as well as utilization counters of
394 every process that uses a GPU. When atop notices that the daemon is
395 active, it reads these GPU utilization counters with every interval.
396 The atopgpud daemon is written in Python, so a Python interpreter
398 should be installed on the target system. For the gathering of the
399 statistics, the pynvml module is used by the daemon. Be sure that this
400 module is installed on the target system before activating the daemon,
401 by running the command pip as root user:
402 pip install nvidia-ml-py
404 The atopgpud daemon is installed by default as part of the atop pack‐
406 age, but it is not automatically enabled. The daemon can be enabled
407 and started now by running the following commands (as root):
408 systemctl enable atopgpu
410 systemctl start atopgpu
411 Find a description about the utilization counters in the section OUTPUT
413 DESCRIPTION.
414
416 When running atop interactively (no output redirection), keys can be
417 pressed to control the output. In general, lower case keys can be used
418 to show other information for the active processes while certain upper
419 case keys can be used to influence the sort order of the active
420 process/thread list. Some of these keys can also be used to switch from
421 bar graph mode to particular detailed process information in text mode.
422 g Show generic output (default).
424 Per process the following fields are shown in case of a window-
426 width of 80 positions: process-id, CPU consumption during the last
427 interval in system and user mode, the virtual and resident memory
428 growth of the process.
429 The data transfer per process for read/write on disk can only be
430 shown when atop runs with root privileges.
431 When the kernel module 'netatop' is loaded, the data transfer for
432 send/receive of network packets is shown for each process.
433 The last columns contain the state, the occupation percentage for
434 the chosen resource (default: CPU) and the process name.
435 When more than 80 positions are available, other information is
437 added.
438 m Show memory related output.
440 Per process the following fields are shown in case of a window
442 width of 80 positions: process-id, minor and major memory faults,
443 size of virtual shared text, total virtual process size, total
444 resident process size, virtual and resident growth during last in‐
445 terval, memory occupation percentage and process name.
446 When more than 80 positions are available, other information is
448 added.
449 For memory consumption, always all processes are shown (also the
451 processes that were not active during the interval).
452 d Show disk-related output.
454 When atop runs with root privileges, the following fields are
456 shown: process-id, amount of data read from disk, amount of data
457 written to disk, amount of data that was written but has been
458 withdrawn again (WCANCL), disk occupation percentage and process
459 name.
460 n Show network related output.
462 Per process the following fields are shown in case of a window
464 width of 80 positions: process-id, thread-id, total bandwidth for
465 received packets, total bandwidth for sent packets, number of re‐
466 ceived TCP packets with the average size per packet (in bytes),
467 number of sent TCP packets with the average size per packet (in
468 bytes), number of received UDP packets with the average size per
469 packet (in bytes), number of sent UDP packets with the average
470 size per packet (in bytes), the network occupation percentage and
471 process name.
472 This information can only be shown when kernel module 'netatop' is
473 installed.
474 When more than 80 positions are available, other information is
476 added.
477 s Show scheduling characteristics.
479 Per process the following fields are shown in case of a window
481 width of 80 positions: process-id, number of threads in state
482 'running' (R), number of threads in state 'interruptible sleeping'
483 (S), number of threads in state 'uninterruptible sleeping' (D),
484 scheduling policy (normal timesharing, realtime round-robin, real‐
485 time fifo), nice value, priority, realtime priority, current pro‐
486 cessor, status, exit code, state, the occupation percentage for
487 the chosen resource and the process name.
488 When more than 80 positions are available, other information is
490 added.
491 v Show various process characteristics.
493 Per process the following fields are shown in case of a window
495 width of 80 positions: process-id, user name and group, start date
496 and time, status (e.g. exit code if the process has finished),
497 state, the occupation percentage for the chosen resource and the
498 process name.
499 When more than 80 positions are available, other information is
501 added.
502 c Show the command line of the process.
504 Per process the following fields are shown: process-id, the occu‐
506 pation percentage for the chosen resource and the command line in‐
507 cluding arguments.
508 X Show cgroup v2 information.
510 Per process the following fields are shown: process-id,
512 'cpu.weight' of the cgroup the process belongs to, 'cpu.max' value
513 (recalculated as percentage) of the cgroup the process belongs to,
514 most restrictive 'cpu.max' value found in the upper directories,
515 'memory.max' value of the cgroup the process belongs to, most re‐
516 strictive 'memory.max' value found in the upper directories, 'mem‐
517 ory.swap.max' value of the cgroup the process belongs to, most re‐
518 strictive 'memory.swap.max' value found in the upper directories,
519 the command name, and the cgroup path name (horizontally scrol‐
520 lable).
521 e Show GPU utilization.
523 Per process at least the following fields are shown: process-id,
525 range of GPU numbers on which the process currently runs, GPU busy
526 percentage on all GPUs, memory busy percentage (i.e. read and
527 write accesses on memory) on all GPUs, memory occupation at the
528 moment of the sample, average memory occupation during the sample,
529 and GPU percentage.
530 When the atopgpud daemon does not run with root privileges, the
532 GPU busy percentage and the memory busy percentage are not avail‐
533 able on process level. In that case, the GPU percentage on
534 process level reflects the GPU memory occupation instead of the
535 GPU busy percentage (which is preferred).
536 o Show the user-defined line of the process.
538 In the configuration file the keyword ownprocline can be specified
540 with the description of a user-defined output-line.
541 Refer to the man-page of atoprc for a detailed description.
542 y Show the individual threads within a process (toggle).
544 Single-threaded processes are still shown as one line.
546 For multi-threaded processes, one line represents the process
547 while additional lines show the activity per individual thread (in
548 a different color). Depending on the option 'a' (all or active
549 toggle), all threads are shown or only the threads that were ac‐
550 tive during the last interval. Depending on the option 'Y' (sort
551 threads), the threads per process will be sorted on the chosen
552 sort criterium or not.
553 Whether this key is active or not can be seen in the header line.
554 Y Sort the threads per process when combined with option 'y' (tog‐
556 gle).
557 u Show the process activity accumulated per user.
559 Per user the following fields are shown: number of processes ac‐
561 tive or terminated during last interval (or in total if combined
562 with command 'a'), accumulated CPU consumption during last inter‐
563 val in system and user mode, the current virtual and resident mem‐
564 ory space consumed by active processes (or all processes of the
565 user if combined with command 'a').
566 When atop runs with root privileges, the accumulated read and
567 write throughput on disk is shown. When the kernel module 'ne‐
568 tatop' has been installed, the accumulated number of received and
569 sent network packets is shown.
570 The last columns contain the accumulated occupation percentage for
571 the chosen resource (default: CPU) and the user name.
572 p Show the process activity accumulated per program (i.e. process
574 name).
575 Per program the following fields are shown: number of processes
577 active or terminated during last interval (or in total if combined
578 with command 'a'), accumulated CPU consumption during last inter‐
579 val in system and user mode, the current virtual and resident mem‐
580 ory space consumed by active processes (or all processes of the
581 user if combined with command 'a').
582 When atop runs with root privileges, the accumulated read and
583 write throughput on disk is shown. When the kernel module 'ne‐
584 tatop' has been installed, the accumulated number of received and
585 sent network packets is shown.
586 The last columns contain the accumulated occupation percentage for
587 the chosen resource (default: CPU) and the program name.
588 j Show the process activity accumulated per Docker container.
590 Per container the following fields are shown: number of processes
592 active or terminated during last interval (or in total if combined
593 with command 'a'), accumulated CPU consumption during last inter‐
594 val in system and user mode, the current virtual and resident mem‐
595 ory space consumed by active processes (or all processes of the
596 user if combined with command 'a').
597 When atop runs with root privileges, the accumulated read and
598 write throughput on disk is shown. When the kernel module 'ne‐
599 tatop' has been installed, the accumulated number of received and
600 sent network packets is shown.
601 The last columns contain the accumulated occupation percentage for
602 the chosen resource (default: CPU) and the Docker container id
603 (CID).
604 C Sort the current list in the order of CPU consumption (default).
606 The one-but-last column changes to 'CPU'.
607 E Sort the current list in the order of GPU utilization (preferred,
609 but only applicable when the atopgpud daemon runs under root priv‐
610 ileges) or the order of GPU memory occupation). The one-but-last
611 column changes to 'GPU'.
612 M Sort the current list in the order of resident memory consumption.
614 The one-but-last column changes to 'MEM'. In case of sorting on
615 memory, the full process list will be shown (not only the active
616 processes).
617 D Sort the current list in the order of disk accesses issued. The
619 one-but-last column changes to 'DSK'.
620 N Sort the current list in the order of network bandwidth (received
622 and transmitted). The one-but-last column changes to 'NET'.
623 A Sort the current list automatically in the order of the most busy
625 system resource during this interval. The one-but-last column
626 shows either 'ACPU', 'AMEM', 'ADSK' or 'ANET' (the preceding 'A'
627 indicates automatic sorting-order). The most busy resource is de‐
628 termined by comparing the weighted busy-percentages of the system
629 resources, as described earlier in the section COLORS.
630 This option remains valid until another sorting-order is explic‐
631 itly selected again.
632 A sorting order for disk is only possible when atop runs with root
633 privileges.
634 A sorting order for network is only possible when the kernel mod‐
635 ule 'netatop' is loaded.
636 Miscellaneous interactive commands:
638 ? Request for help information (also the key 'h' can be pressed).
640 V Request for version information (version number and date).
642 R Gather and calculate the proportional set size of processes (tog‐
644 gle). Gathering of all values that are needed to calculate the
645 PSIZE of a process is a very time-consuming task, so this key
646 should only be active when analyzing the resident memory consump‐
647 tion of processes.
648 W Get the WCHAN per thread (toggle). Gathering of the WCHAN string
650 per thread is a relatively time-consuming task, so this key should
651 only be made active when analyzing the reason for threads to be in
652 sleep state.
653 x Suppress colors to highlight critical resources (toggle).
655 Whether this key is active or not can be seen in the header line.
656 z The pause key can be used to freeze the current situation in order
658 to investigate the output on the screen. While atop is paused, the
659 keys described above can be pressed to show other information
660 about the current list of processes. Whenever the pause key is
661 pressed again, atop will continue with a next sample.
662 The pause key can be used in text mode and bar graph mode.
663 i Modify the interval timer (default: 10 seconds). If an interval
665 timer of 0 is entered, the interval timer is switched off. In that
666 case a new sample can only be triggered manually by pressing the
667 key 't'.
668 The interval can be modified in text mode and bar graph mode.
669 t Trigger a new sample manually. This key can be pressed if the cur‐
671 rent sample should be finished before the timer has exceeded, or
672 if no timer is set at all (interval timer defined as 0). In the
673 latter case atop can be used as a stopwatch to measure the load
674 being caused by a particular application transaction, without
675 knowing on beforehand how many seconds this transaction will last.
676 This key can be used in text mode and bar graph mode.
677 When viewing the contents of a raw file this key can be used to
679 show the next sample from the file. This key can also be used when
680 viewing raw data via a pipe.
681 T When viewing the contents of a raw file this key can be used to
683 show the previous sample from the file, however not when reading
684 raw data from a pipe.
685 This key can be used in text mode and bar graph mode.
686 b When viewing the contents of a raw file, this key can be used to
688 branch to a certain timestamp within the file either forward or
689 backward. When viewing raw data from a pipe only forward branches
690 are possible.
691 This key can be used in text mode and bar graph mode.
692 r Reset all counters to zero to see the system and process activity
694 since boot again.
695 This key can be used in text mode and bar graph mode.
696 When viewing the contents of a raw file, this key can be used to
698 rewind to the beginning of the file again (except when reading raw
699 data from a pipe).
700 U Specify a search string for specific user names as a regular ex‐
702 pression. From now on, only (active) processes will be shown from
703 a user which matches the regular expression. The system statis‐
704 tics are still system wide. If the Enter-key is pressed without
705 specifying a name, (active) processes of all users will be shown
706 again.
707 Whether this key is active or not can be seen in the header line.
708 I Specify a list with one or more PIDs to be selected. From now on,
710 only processes will be shown with a PID which matches one of the
711 given list. The system statistics are still system wide. If the
712 Enter-key is pressed without specifying a PID, all (active) pro‐
713 cesses will be shown again.
714 Whether this key is active or not can be seen in the header line.
715 P Specify a search string for specific process names as a regular
717 expression. From now on, only processes will be shown with a name
718 which matches the regular expression. The system statistics are
719 still system wide. If the Enter-key is pressed without specifying
720 a name, all (active) processes will be shown again.
721 Whether this key is active or not can be seen in the header line.
722 / Specify a specific command line search string as a regular expres‐
724 sion. From now on, only processes will be shown with a command
725 line which matches the regular expression. The system statistics
726 are still system wide. If the Enter-key is pressed without speci‐
727 fying a string, all (active) processes will be shown again.
728 Whether this key is active or not can be seen in the header line.
729 J Specify a Docker container id of 12 (hexadecimal) characters.
731 From now on, only processes will be shown that run in that spe‐
732 cific Docker container (CID). The system statistics are still
733 system wide. If the Enter-key is pressed without specifying a
734 container id, all (active) processes will be shown again.
735 Whether this key is active or not can be seen in the header line.
736 Q Specify a comma-separated list of process/thread state characters.
738 From now on, only processes/threads will be shown that are in
739 those specific states. Accepted states are: R (running), S
740 (sleeping), D (disk sleep), I (idle), T (stopped), t (tracing
741 stop), X (dead), Z (zombie) and P (parked). The system statistics
742 are still system wide. If the Enter-key is pressed without speci‐
743 fying a state, all (active) processes/threads will be shown again.
744 Whether this key is active or not can be seen in the header line.
745 S Specify search strings for specific logical volume names, specific
747 disk names and specific network interface names. All search
748 strings are interpreted as a regular expressions. From now on,
749 only those system resources are shown that match the concerning
750 regular expression. If the Enter-key is pressed without specify‐
751 ing a search string, all (active) system resources of that type
752 will be shown again.
753 Whether this key is active or not can be seen in the header line.
754 a The 'all/active' key can be used to toggle between only show‐
756 ing/accumulating the processes that were active during the last
757 interval (default) or showing/accumulating all processes.
758 Whether this key is active or not can be seen in the header line.
759 G By default, atop shows/accumulates the processes that are alive
761 and the processes that are exited during the last interval. With
762 this key (toggle), showing/accumulating the processes that are ex‐
763 ited can be suppressed.
764 Whether this key is active or not can be seen in the header line.
765 f Show a fixed (maximum) number of header lines for system resources
767 (toggle). By default only the lines are shown about system re‐
768 sources (CPUs, paging, logical volumes, disks, network interfaces)
769 that really have been active during the last interval. With this
770 key you can force atop to show lines of inactive resources as
771 well.
772 Whether this key is active or not can be seen in the header line.
773 F Suppress sorting of system resources (toggle). By default system
775 resources (CPUs, logical volumes, disks, network interfaces) are
776 sorted on utilization.
777 Whether this key is active or not can be seen in the header line.
778 1 Show relevant counters as an average per second (in the format
780 '..../s') instead of as a total during the interval (toggle).
781 Whether this key is active or not can be seen in the header line.
782 l Limit the number of system level lines for the counters per-cpu,
784 the active disks and the network interfaces. By default lines are
785 shown of all CPUs, disks and network interfaces which have been
786 active during the last interval. Limiting these lines can be use‐
787 ful on systems with huge number CPUs, disks or interfaces in order
788 to be able to run atop on a screen/window with e.g. only 24 lines.
789 For all mentioned resources the maximum number of lines can be
790 specified interactively. When using the flag -l the maximum number
791 of per-cpu lines is set to 0, the maximum number of disk lines to
792 5 and the maximum number of interface lines to 3. These values
793 can be modified again in interactive mode.
794 k Send a signal to an active process (a.k.a. kill a process).
796 q Quit the program.
798 This key can be used in text mode and bar graph mode.
799 PgDn Show the next page of the process/thread list.
801 With the arrow-down key the list can be scrolled downwards with
802 single lines.
803 ^F Show the next page of the process/thread list (forward).
805 With the arrow-down key the list can be scrolled downwards with
806 single lines.
807 PgUp Show the previous page of the process/thread list.
809 With the arrow-up key the list can be scrolled upwards with single
810 lines.
811 ^B Show the previous page of the process/thread list (backward).
813 With the arrow-up key the list can be scrolled upwards with single
814 lines.
815 ^L Redraw the screen.
817
819 In order to store system and process level statistics for long-term
820 analysis (e.g. to check the system load and the active processes run‐
821 ning yesterday between 3:00 and 4:00 PM), atop can store the system and
822 process level statistics in compressed binary format in a raw file with
823 the flag -w followed by the filename. If this file already exists and
824 is recognized as a raw data file, atop will append new samples to the
825 file (starting with a sample which reflects the activity since boot).
826 If the file does not exist, it will be created.
827 All information about system, processes and thread activity is stored
828 in the raw file.
829 The interval (default: 10 seconds) and number of samples (default: in‐
830 finite) can be passed as last arguments. Instead of the number of sam‐
831 ples, the flag -S can be used to indicate that atop should finish any‐
832 how before midnight.
833 A raw file can be read and visualized again with the flag -r followed
835 by the filename. If no filename is specified, the file
836 /var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are
837 digits representing the current date). If a filename is specified in
838 the format YYYYMMDD (representing any valid date), the file
839 /var/log/atop/atop_YYYYMMDD is opened. If a filename with the symbolic
840 name y is specified, yesterday's daily logfile is opened (this can be
841 repeated so 'yyyy' indicates the logfile of four days ago). If the
842 filename - is used, stdin will be read.
843 The samples from the file can be viewed interactively by using the key
844 't' to show the next sample, the key 'T' to show the previous sample,
845 the key 'b' to branch to a particular time or the key 'r' to rewind to
846 the begin of the file. These keys can be used in text mode as well as
847 in bar graph mode.
848 When output is redirected to a file or pipe, atop prints all samples in
849 plain ASCII. The default line length is 80 characters in that case.
850 With the flag -L followed by an alternate line length, more (or less)
851 columns will be shown.
852 With the flag -b (begin time) and/or -e (end time) followed by a time
853 argument of the form [YYYYMMDD]hhmm, a certain time period within the
854 raw file can be selected.
855 Every day at midnight atop is restarted by the atop-rotate.timer and
857 atop-rotate.service unit files, to write compressed binary data to the
858 file /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes by de‐
859 fault.
860 Furthermore all raw files are removed that are older than 28 days (by
861 default).
862 The mentioned default values can be overruled in the file /etc/de‐
863 fault/atop that might contain other values for LOGOPTS (by default
864 without any flag), LOGINTERVAL (in seconds, by default 600), LOGGENERA‐
865 TIONS (in days, by default 28), and LOGPATH (directory in which log‐
866 files are stored).
867 Unfortunately, it is not always possible to keep the format of the raw
869 files compatible in newer versions of atop especially when many new
870 counters have to be maintained. Therefore, the program atopconvert is
871 installed to convert a raw file created by an older version of atop to
872 a raw file that can be read by a newer version of atop (see the man
873 page of atopconvert for more details).
874
877 The first sample shows the system level activity since boot (the
878 elapsed time in the header shows the time since boot).
879 In text mode, atop first shows the lines related to system level activ‐
881 ity for every sample. If a particular system resource has not been
882 used during the interval, the entire line related to this resource is
883 suppressed. So the number of system level lines may vary for each sam‐
884 ple.
885 After that a list is shown of processes which have been active during
886 the last interval. This list is sorted on CPU consumption by default,
887 but this order can be changed by the keys which are previously de‐
888 scribed.
889 If values have to be shown by atop which do not fit in the column
891 width, another format is used. If e.g. a CPU consumption of 233216 mil‐
892 liseconds should be shown in a column width of 4 positions, it is shown
893 as '233s' (in seconds). For large memory figures, another unit is cho‐
894 sen if the value does not fit (Mb instead of Kb, Gb instead of Mb, Tb
895 instead of Gb, etcetera). For other values, a kind of exponent nota‐
896 tion is used (value 123456789 shown in a column of 5 positions gives
897 123e6).
898
900 The system level information in text mode consists of the following
901 output lines:
902 PRC Process and thread level totals.
904 This line contains the total CPU time consumed in system mode
905 ('sys') and in user mode ('user'), the total number of processes
906 present at this moment ('#proc'), the total number of threads
907 present at this moment in state 'running' ('#trun'), 'sleeping in‐
908 terruptible' ('#tslpi') and 'sleeping uninterruptible' ('#tslpu'),
909 the number of zombie processes ('#zombie'), the number of clone
910 system calls ('clones'), and the number of processes that ended
911 during the interval ('#exit') when process accounting is used. In‐
912 stead of '#exit' the last column may indicate that process ac‐
913 counting could not be activated ('no procacct').
914 If the screen-width does not allow all of these counters, only a
915 relevant subset is shown.
916 CPU CPU utilization.
918 At least one line is shown for the total occupation of all CPUs
919 together.
920 In case of a multi-processor system, an additional line is shown
921 for every individual processor (with 'cpu' in lower case), sorted
922 on activity. Inactive CPUs will not be shown by default. The
923 lines showing the per-cpu occupation contain the CPU number in the
924 field combined with the wait percentage.
925 Every line contains the percentage of CPU time spent in kernel
927 mode by all active processes ('sys'), the percentage of CPU time
928 consumed in user mode ('user') for all active processes (including
929 processes running with a nice value larger than zero), the per‐
930 centage of CPU time spent for interrupt handling ('irq') including
931 softirq, the percentage of unused CPU time while no processes were
932 waiting for disk I/O ('idle'), and the percentage of unused CPU
933 time while at least one process was waiting for disk I/O ('wait').
934 In case of per-cpu occupation, the CPU number and the wait per‐
935 centage ('w') for that CPU. The number of lines showing the per-
936 cpu occupation can be limited.
937 For virtual machines, the steal-percentage ('steal') shows the
939 percentage of CPU time stolen by other virtual machines running on
940 the same hardware.
941 For physical machines hosting one or more virtual machines, the
942 guest percentage ('guest') shows the percentage of CPU time used
943 by the virtual machines. Notice that this percentage overlaps the
944 user percentage!
945 When PMC performance monitoring counters are supported by the CPU
947 and the kernel (and atop runs with root privileges), the number of
948 instructions per CPU cycle ('ipc') is shown. The first sample al‐
949 ways shows the value 'initial', because the counters are just ac‐
950 tivated at the moment that atop is started.
951 When the CPU busy percentage is high and the IPC is less than 1.0,
952 it is likely that the CPU is frequently waiting for memory access
953 during instruction execution (larger CPU caches or faster memory
954 might be helpful to improve performance). When the CPU busy per‐
955 centage is high and the IPC is greater than 1.0, it is likely that
956 the CPU is instruction-bound (more/faster cores might be helpful
957 to improve performance).
958 Furthermore, per CPU the effective number of cycles ('cycl') is
959 shown. This value can reach the current CPU frequency if such CPU
960 is 100% busy. When an idle CPU is halted, the number of effective
961 cycles can be (considerably) lower than the current frequency.
962 Notice that the average instructions per cycle and number of cy‐
963 cles is shown in the CPU line for all CPUs.
964 Beware that reading the cycle counter in virtual machines (guests)
965 might introduce performance delays. Therefore this metric is by
966 default disabled in virtual machines. However, with the keyword
967 'perfevents' in the atoprc file this metric can be explicitly set
968 to 'enable' or 'disable' (see separate man-page of atoprc).
969 See also: http://www.brendangregg.com/blog/2017-05-09/cpu-utiliza‐
970 tion-is-wrong.html
971 In case of frequency scaling, all previously mentioned CPU per‐
973 centages are relative to the used scaling of the CPU during the
974 interval. If a CPU has been active for e.g. 50% in user mode dur‐
975 ing the interval while the frequency scaling of that CPU was 40%,
976 only 20% of the full capacity of the CPU has been used in user
977 mode.
978 In case that the kernel module 'cpufreq_stats' is active (after
979 issuing 'modprobe cpufreq_stats'), the average frequency ('avgf')
980 and the average scaling percentage ('avgscal') is shown. Otherwise
981 the current frequency ('curf') and the current scaling percentage
982 ('curscal') is shown at the moment that the sample is taken. No‐
983 tice that average values for frequency and scaling are shown in
984 the CPU line for every CPU.
985 Frequency scaling statistics are only gathered for systems with
986 maximum 8 CPUs, since gathering of these values per CPU is very
987 time consuming.
988 If the screen-width does not allow all of these counters, only a
990 relevant subset is shown.
991 CPL CPU load information.
993 This line contains the load average figures reflecting the number
994 of threads that are available to run on a CPU (i.e. part of the
995 runqueue) or that are waiting for disk I/O. These figures are av‐
996 eraged over 1 ('avg1'), 5 ('avg5') and 15 ('avg15') minutes.
997 Furthermore the number of context switches ('csw'), the number of
998 serviced interrupts ('intr') and the number of available CPUs are
999 shown.
1000 If the screen-width does not allow all of these counters, only a
1002 relevant subset is shown.
1003 GPU GPU utilization (Nvidia).
1005 Read the section GPU STATISTICS GATHERING in this document to find
1006 the details about the activation of the atopgpud daemon.
1007 In the first column of every line, the bus-id (last nine charac‐
1009 ters) and the GPU number are shown. The subsequent columns show
1010 the percentage of time that one or more kernels were executing on
1011 the GPU ('gpubusy'), the percentage of time that global (device)
1012 memory was being read or written ('membusy'), the occupation per‐
1013 centage of memory ('memocc'), the total memory ('total'), the mem‐
1014 ory being in use at the moment of the sample ('used'), the average
1015 memory being in use during the sample time ('usavg'), the number
1016 of processes being active on the GPU at the moment of the sample
1017 ('#proc'), and the type of GPU.
1018 If the screen-width does not allow all of these counters, only a
1020 relevant subset is shown.
1021 The number of lines showing the GPUs can be limited.
1022 MEM Memory occupation (two lines).
1024 These lines contain the total amount of physical memory ('tot'),
1025 the amount of memory which is currently free ('free'), the amount
1026 of memory in use as page cache including the total resident shared
1027 memory ('cache'), the amount of memory within the page cache that
1028 has to be flushed to disk ('dirty'), the amount of memory used for
1029 filesystem meta data ('buff'), the amount of memory being used for
1030 kernel mallocs ('slab'), the amount of slab memory that is re‐
1031 claimable ('slrec'), the resident size of shared memory including
1032 tmpfs ('shmem'), the resident size of shared memory ('shrss') the
1033 amount of shared memory that is currently swapped ('shswp'), the
1034 amount of memory that is currently used for page tables ('pgtab'),
1035 the number of NUMA nodes in this system ('numnode'), the amount of
1036 memory that is currently claimed by vmware's balloon driver ('vm‐
1037 bal'), the amount of memory that is currently claimed by the ARC
1038 (cache) of ZFSonlinux ('zfarc'), the amount of memory that is
1039 claimed for huge pages ('hptot'), the amount of huge page memory
1040 that is really in use ('hpuse'), the amount of memory that is used
1041 for TCP sockets ('tcps'), and the amount of memory that is used
1042 for UDP sockets ('udps').
1043 If the screen-width does not allow all of these counters, only a
1045 relevant subset is shown.
1046 SWP Swap occupation and overcommit info.
1048 This line contains the total amount of swap space on disk ('tot'),
1049 the amount of free swap space ('free'), the size of the swap cache
1050 ('swcac'), the total size of compressed storage in zswap
1051 ('zpool'), the total size of the compressed pages stored in zswap
1052 ('zstor'), the total size of the memory used for KSM ('ksuse',
1053 i.e. shared), and the total size of the memory saved (deduped) by
1054 KSM ('kssav', i.e. sharing).
1055 Furthermore the committed virtual memory space ('vmcom') and the
1056 maximum limit of the committed space ('vmlim', which is by default
1057 swap size plus 50% of memory size) is shown. The committed space
1058 is the reserved virtual space for all allocations of private mem‐
1059 ory space for processes. The kernel only verifies whether the com‐
1060 mitted space exceeds the limit if strict overcommit handling is
1061 configured (vm.overcommit_memory is 2).
1062 LLC Last-Level Cache of CPU info.
1064 This line contains the total memory bandwidth of LLC ('tot'), the
1065 bandwidth of the local NUMA node ('loc'), and the percentage of
1066 LLC in use ('LLCXX YY%').
1067 Note that this feature depends on the 'resctrl' pseudo filesystem.
1069 Be sure that the kernel is built with the relevant config and take
1070 care that the pseudo-filesystem is mounted:
1071 mount -t resctrl resctrl -o mba_MBps /sys/fs/resctrl (on Intel)
1073 mount -t resctrl resctrl -o cdp /sys/fs/resctrl (on AMD)
1074 NUM Memory utilization per NUMA node (not shown for single NUMA node).
1076 This line shows the total amount of physical memory of this node
1077 ('tot'), the amount of free memory ('free'), the amount of memory
1078 for cached file data ('file'), modified cached file data
1079 ('dirty'), recently used memory ('activ'), less recently used mem‐
1080 ory ('inact'), memory being used for kernel mallocs ('slab'), the
1081 amount of slab memory that is reclaimable ('slrec'), shared memory
1082 including tmpfs ('shmem'), total huge pages ('hptot') and the
1083 fragmentation percentage ('frag').
1084 NUC CPU utilization per NUMA node (not shown for single NUMA node).
1086 This line shows the utilization percentages of all CPUs related to
1087 this NUMA node, categorized for system mode ('sys'), user mode
1088 ('user'), user mode for niced processes ('niced'), idle mode
1089 ('idle'), wait mode ('w' preceded by the node number), irq mode
1090 ('irq'), softirq mode ('sirq'), steal mode ('steal'), and guest
1091 mode ('guest') overlapping user mode.
1092 PAG Paging frequency.
1094 This line contains the number of scanned pages ('scan') due to the
1095 fact that free memory drops below a particular threshold, the num‐
1096 ber of reclaimed pages('steal') due to the fact that free memory
1097 drops below a particular threshold, the number times that the ker‐
1098 nel tries to reclaim pages due to an urgent need ('stall'),the
1099 number of process stalls to run memory compaction to allocate huge
1100 pages ('compact'), the number of NUMA pages migrated ('numamig'),
1101 and the total number of memory pages migrated successfully e.g.
1102 between NUMA nodes or for compaction ('migrate') are shown.
1103 Also the number of memory pages the system read from block devices
1104 ('pgin'), the number of memory pages the system wrote to block de‐
1105 vices ('pgout'), the number of memory pages the system read from
1106 swap space ('swin'), the number of memory pages the system wrote
1107 to swap space ('swout'), and the number of out-of-memory kills
1108 ('oomkill').
1109 PSI Pressure Stall Information.
1111 This line contains percentages about resource pressure related to
1112 CPU, memory and I/O. Certain percentages refer to 'some' meaning
1113 that some processes/threads were delayed due to resource overload.
1114 Other percentages refer to 'full' meaning a loss of overall
1115 throughput due to resource overload.
1116 The values 'cpusome', 'memsome', 'memfull', 'iosome' and 'iofull'
1117 show the pressure percentage during the entire interval.
1118 The values 'cs' (cpu some), 'ms' (memory some), 'mf' (memory
1119 full), 'is' (I/O some) and 'if' (I/O full) each show three per‐
1120 centages separated by slashes: pressure percentage over the last
1121 10, 60 and 300 seconds.
1122 LVM/MDD/DSK
1124 Logical volume/multiple device/disk utilization.
1125 Per active unit one line is produced, sorted on unit activity.
1126 Such line shows the name (e.g. VolGroup00-lvtmp for a logical vol‐
1127 ume or sda for a hard disk), the percentage of elapsed time during
1128 which I/O requests were issued to the device ('busy') (note that
1129 for devices serving requests in parallel, such as RAID arrays, SSD
1130 and NVMe, this number does not reflect their performance limits),
1131 the number of read requests issued ('read'), the number of write
1132 requests issued ('write'), the number of discard requests issued
1133 ('discrd') if supported by kernel version, the number of KiBytes
1134 per read ('KiB/r'), the number of KiBytes per write ('KiB/w'), the
1135 number of KiBytes per discard ('KiB/d') if supported by kernel
1136 version, the number of MiBytes per second throughput for reads
1137 ('MBr/s'), the number of MiBytes per second throughput for writes
1138 ('MBw/s'), requests issued to the device driver but not completed
1139 ('inflt'), the average queue depth while busy ('avq') and the av‐
1140 erage number of milliseconds needed by a request ('avio') for
1141 seek, latency and data transfer.
1142 If the screen-width does not allow all of these counters, only a
1143 relevant subset is shown.
1144 The number of lines showing the units can be limited per class
1146 (LVM, MDD or DSK) with the 'l' key or statically (see separate
1147 man-page of atoprc). By specifying the value 0 for a particular
1148 class, no lines will be shown any more for that class.
1149 NFM Network Filesystem (NFS) mount at the client side.
1151 For each NFS-mounted filesystem, a line is shown that contains the
1152 mounted server directory, the name of the server ('srv'), the to‐
1153 tal number of bytes physically read from the server ('read') and
1154 the total number of bytes physically written to the server
1155 ('write'). Data transfer is subdivided in the number of bytes
1156 read via normal read() system calls ('nread'), the number of bytes
1157 written via normal read() system calls ('nwrit'), the number of
1158 bytes read via direct I/O ('dread'), the number of bytes written
1159 via direct I/O ('dwrit'), the number of bytes read via memory
1160 mapped I/O pages ('mread'), and the number of bytes written via
1161 memory mapped I/O pages ('mwrit').
1162 NFC Network Filesystem (NFS) client side counters.
1164 This line contains the number of RPC calls issues by local pro‐
1165 cesses ('rpc'), the number of read RPC calls ('read') and write
1166 RPC calls ('rpwrite') issued to the NFS server, the number of RPC
1167 calls being retransmitted ('retxmit') and the number of authoriza‐
1168 tion refreshes ('autref').
1169 NFS Network Filesystem (NFS) server side counters.
1171 This line contains the number of RPC calls received from NFS
1172 clients ('rpc'), the number of read RPC calls received ('cread'),
1173 the number of write RPC calls received ('cwrit'), the number of
1174 Megabytes/second returned to read requests by clients ('MBcr/s'),
1175 the number of Megabytes/second passed in write requests by clients
1176 ('MBcw/s'), the number of network requests handled via TCP
1177 ('nettcp'), the number of network requests handled via UDP ('ne‐
1178 tudp'), the number of reply cache hits ('rchits'), the number of
1179 reply cache misses ('rcmiss') and the number of uncached requests
1180 ('rcnoca'). Furthermore some error counters indicating the number
1181 of requests with a bad format ('badfmt') or a bad authorization
1182 ('badaut'), and a counter indicating the number of bad clients
1183 ('badcln').
1184 NET Network utilization (TCP/IP).
1186 One line is shown for activity of the transport layer (TCP and
1187 UDP), one line for the IP layer and one line per active interface.
1188 For the transport layer, counters are shown concerning the number
1189 of received TCP segments including those received in error
1190 ('tcpi'), the number of transmitted TCP segments excluding those
1191 containing only retransmitted octets ('tcpo'), the number of UDP
1192 datagrams received ('udpi'), the number of UDP datagrams transmit‐
1193 ted ('udpo'), the number of active TCP opens ('tcpao'), the number
1194 of passive TCP opens ('tcppo'), the number of TCP output retrans‐
1195 missions ('tcprs'), the number of TCP input errors ('tcpie'), the
1196 number of TCP output resets ('tcpor'), the number of UDP no ports
1197 ('udpnp'), and the number of UDP input errors ('udpie').
1198 If the screen-width does not allow all of these counters, only a
1199 relevant subset is shown.
1200 These counters are related to IPv4 and IPv6 combined.
1201 For the IP layer, counters are shown concerning the number of IP
1203 datagrams received from interfaces, including those received in
1204 error ('ipi'), the number of IP datagrams that local higher-layer
1205 protocols offered for transmission ('ipo'), the number of received
1206 IP datagrams which were forwarded to other interfaces ('ipfrw'),
1207 the number of IP datagrams which were delivered to local higher-
1208 layer protocols ('deliv'), the number of received ICMP datagrams
1209 ('icmpi'), and the number of transmitted ICMP datagrams ('icmpo').
1210 If the screen-width does not allow all of these counters, only a
1211 relevant subset is shown.
1212 These counters are related to IPv4 and IPv6 combined.
1213 For every active network interface one line is shown, sorted on
1215 the interface activity. Such line shows the name of the interface
1216 and its busy percentage in the first column. The busy percentage
1217 for half duplex is determined by comparing the interface speed
1218 with the number of bits transmitted and received per second; for
1219 full duplex the interface speed is compared with the highest of
1220 either the transmitted or the received bits. When the interface
1221 speed can not be determined (e.g. for the loopback interface),
1222 '---' is shown instead of the percentage.
1223 Furthermore the number of received packets ('pcki'), the number of
1224 transmitted packets ('pcko'), the line speed of the interface
1225 ('sp'), the effective amount of bits received per second ('si'),
1226 the effective amount of bits transmitted per second ('so'), the
1227 number of collisions ('coll'), the number of received multicast
1228 packets ('mlti'), the number of errors while receiving a packet
1229 ('erri'), the number of errors while transmitting a packet
1230 ('erro'), the number of received packets dropped ('drpi'), and the
1231 number of transmitted packets dropped ('drpo').
1232 If the screen-width does not allow all of these counters, only a
1233 relevant subset is shown.
1234 The number of lines showing the network interfaces can be limited.
1235 IFB Infiniband utilization.
1237 For every active Infiniband port one line is shown, sorted on ac‐
1238 tivity. Such line shows the name of the port and its busy per‐
1239 centage in the first column. The busy percentage is determined by
1240 taking the highest of either the transmitted or the received bits
1241 during the interval, multiplying that value by the number of lanes
1242 and comparing it against the maximum port speed.
1243 Furthermore the number of received packets divided by the number
1244 of lanes ('pcki'), the number of transmitted packets divided by
1245 the number of lanes ('pcko'), the maximum line speed ('sp'), the
1246 effective amount of bits received per second ('si'), the effective
1247 amount of bits transmitted per second ('so'), and the number of
1248 lanes ('lanes').
1249 If the screen-width does not allow all of these counters, only a
1250 relevant subset is shown.
1251 The number of lines showing the Infiniband ports can be limited.
1252
1254 Following the system level information, a list of processes is shown in
1255 text mode from which the resource utilization has changed during the
1256 last interval. These processes might have used CPU time or might have
1257 issued disk or network requests. However a process is also shown if
1258 part of it has been paged out due to lack of memory (while the process
1259 itself was in sleep state).
1260 Per process the following fields may be shown (in alphabetical order),
1262 depending on the current output mode as described in the section INTER‐
1263 ACTIVE COMMANDS and depending on the current width of your window:
1264 AVGRSZ The average size of one read-action on disk.
1266 AVGWSZ The average size of one write-action on disk.
1268 BANDWI Total bandwidth for received TCP and UDP packets consumed by
1270 this process (bits-per-second). This value can be compared
1271 with the value 'si' on interface level (used bandwidth per in‐
1272 terface).
1273 This information will only be shown when the kernel module
1274 'netatop' is loaded.
1275 BANDWO Total bandwidth for sent TCP and UDP packets consumed by this
1277 process (bits-per-second). This value can be compared with
1278 the value 'so' on interface level (used bandwidth per inter‐
1279 face).
1280 This information will only be shown when the kernel module
1281 'netatop' is loaded.
1282 BDELAY Aggregated block I/O delay, i.e. time waiting for disk I/O.
1284 CGROUP Path name of the cgroup (version 2) to which this process be‐
1286 longs. This path name is relative to the cgroup root direc‐
1287 tory, which is usually '/sys/fs/cgroup'.
1288 CID Container ID (Docker) of 12 hexadecimal digits, referring to
1290 the container in which the process/thread is running. If a
1291 process has been started and finished during the last inter‐
1292 val, a '?' is shown because the container ID is not part of
1293 the standard process accounting record.
1294 CMD The name of the process. This name can be surrounded by
1296 "less/greater than" signs ('<name>') which means that the
1297 process has finished during the last interval.
1298 Behind the abbreviation 'CMD' in the header line, the current
1299 page number and the total number of pages of the
1300 process/thread list are shown.
1301 COMMAND-LINE
1303 The full command line of the process (including arguments). If
1304 the length of the command line exceeds the length of the
1305 screen line, the arrow keys -> and <- can be used for horizon‐
1306 tal scroll.
1307 Behind the verb 'COMMAND-LINE' in the header line, the current
1308 page number and the total number of pages of the
1309 process/thread list are shown.
1310 CPU The occupation percentage of this process related to the
1312 available capacity for this resource on system level.
1313 CPUMAX The 'cpu.max' value of the cgroup (version 2) to which this
1315 process belongs, calculated as percentage of one CPU.
1316 CPUMAXR The most restrictive (i.e. effective) 'cpu.max' value defined
1318 by the upper directories of the cgroup (version 2) to which
1319 this process belongs, calculated as percentage of one CPU.
1320 CPUNR The identification of the CPU the (main) thread is running on
1322 or has recently been running on.
1323 CPUWGT The 'cpu.weight' value of the cgroup (version 2) to which this
1325 process belongs.
1326 CTID Container ID (OpenVZ). If a process has been started and fin‐
1328 ished during the last interval, a '?' is shown because the
1329 container ID is not part of the standard process accounting
1330 record.
1331 DSK The occupation percentage of this process related to the total
1333 load that is produced by all processes (i.e. total disk ac‐
1334 cesses by all processes during the last interval).
1335 This information is shown when per process "storage account‐
1336 ing" is active in the kernel.
1337 EGID Effective group-id under which this process executes.
1339 ENDATE Date that the process has been finished. If the process is
1341 still running, this field shows 'active'.
1342 ENTIME Time that the process has been finished. If the process is
1344 still running, this field shows 'active'.
1345 ENVID Virtual environment identified (OpenVZ only).
1347 EUID Effective user-id under which this process executes.
1349 EXC The exit code of a terminated process (second position of col‐
1351 umn 'ST' is E) or the fatal signal number (second position of
1352 column 'ST' is S or C).
1353 FSGID Filesystem group-id under which this process executes.
1355 FSUID Filesystem user-id under which this process executes.
1357 GPU When the atopgpud daemon does not run with root privileges,
1359 the GPU percentage reflects the GPU memory occupation percent‐
1360 age (memory of all GPUs is 100%).
1361 When the atopgpud daemon runs with root privileges, the GPU
1362 percentage reflects the GPU busy percentage.
1363 GPUBUSY Busy percentage on all GPUs (one GPU is 100%).
1365 When the atopgpud daemon does not run with root privileges,
1366 this value is not available.
1367 GPUNUMS Comma-separated list of GPUs used by the process during the
1369 interval. When the comma-separated list exceeds the width of
1370 the column, a hexadecimal value is shown.
1371 LOCKSZ The virtual amount of memory being locked (i.e. non-swappable)
1373 by this process (or user).
1374 MAJFLT The number of page faults issued by this process that have
1376 been solved by creating/loading the requested memory page.
1377 MEM The occupation percentage of this process related to the
1379 available capacity for this resource on system level.
1380 MEMAVG Average memory occupation during the interval on all used
1382 GPUs.
1383 MEMBUSY Busy percentage of memory on all GPUs (one GPU is 100%), i.e.
1385 the time needed for read and write accesses on memory.
1386 When the atopgpud daemon does not run with root privileges,
1387 this value is not available.
1388 MEMMAX The 'memory.max' value of the cgroup (version 2) to which this
1390 process belongs.
1391 MEMNOW Memory occupation at the moment of the sample on all used
1393 GPUs.
1394 MMMAXR The most restrictive (i.e. effective) 'memory.max' value de‐
1396 fined by the upper directories of the cgroup (version 2) to
1397 which this process belongs.
1398 MINFLT The number of page faults issued by this process that have
1400 been solved by reclaiming the requested memory page from the
1401 free list of pages.
1402 NET The occupation percentage of this process related to the total
1404 load that is produced by all processes (i.e. consumed network
1405 bandwidth of all processes during the last interval).
1406 This information will only be shown when kernel module 'ne‐
1407 tatop' is loaded.
1408 NICE The more or less static priority that can be given to a
1410 process on a scale from -20 (high priority) to +19 (low prior‐
1411 ity).
1412 NIVCSW Number of times the process/thread was context-switched invol‐
1414 untarily, in case that the time slice expired.
1415 NPROCS The number of active and terminated processes accumulated for
1417 this user or program.
1418 NVCSW Number of times that the process/thread was context-switched
1420 voluntarily in case of a blocking system call, e.g. to wait
1421 for an I/O operation to complete.
1422 PID Process-id. If a process has been started and finished during
1424 the last interval, a '?' is shown because the process-id is
1425 not part of the standard process accounting record.
1426 POLI The policies 'norm' (normal, which is SCHED_OTHER), 'btch'
1428 (batch) and 'idle' refer to timesharing processes. The poli‐
1429 cies 'fifo' (SCHED_FIFO) and 'rr' (round robin, which is
1430 SCHED_RR) refer to realtime processes.
1431 PPID Parent process-id. If a process has been started and finished
1433 during the last interval, value 0 is shown because the parent
1434 process-id is not part of the standard process accounting
1435 record.
1436 PRI The process' priority ranges from 0 (highest priority) to 139
1438 (lowest priority). Priority 0 to 99 are used for realtime pro‐
1439 cesses (fixed priority independent of their behavior) and pri‐
1440 ority 100 to 139 for timesharing processes (variable priority
1441 depending on their recent CPU consumption and the nice value).
1442 PSIZE The proportional memory size of this process (or user).
1444 Every process shares resident memory with other processes.
1445 E.g. when a particular program is started several times, the
1446 code pages (text) are only loaded once in memory and shared by
1447 all incarnations. Also the code of shared libraries is shared
1448 by all processes using that shared library, as well as shared
1449 memory and memory-mapped files. For the PSIZE calculation of
1450 a process, the resident memory of a process that is shared
1451 with other processes is divided by the number of sharers.
1452 This means, that every process is accounted for a proportional
1453 part of that memory. Accumulating the PSIZE values of all pro‐
1454 cesses in the system gives a reliable impression of the total
1455 resident memory consumed by all processes.
1456 Since gathering of all values that are needed to calculate the
1457 PSIZE is a very time-consuming task, the 'R' key (or '-R'
1458 flag) should be active. Gathering these values also requires
1459 superuser privileges (otherwise '?K' is shown in the output).
1460 If a process has finished during the last interval, no value
1461 is shown since the proportional memory size is not part of the
1462 standard process accounting record.
1463 RDDSK The read data transfer issued physically on disk (so reading
1465 from the disk cache is not accounted for).
1466 Unfortunately, the kernel aggregates the data transfer of a
1467 process to the data transfer of its parent process when termi‐
1468 nating, so you might see transfers for (parent) processes like
1469 cron, bash or init, that are not really issued by them.
1470 RDELAY Runqueue delay, i.e. time spent waiting on a runqueue.
1472 RGID The real group-id under which the process executes.
1474 RGROW The amount of resident memory that the process has grown dur‐
1476 ing the last interval. A resident growth can be caused by
1477 touching memory pages which were not physically created/loaded
1478 before (load-on-demand). Note that a resident growth can also
1479 be negative e.g. when part of the process is paged out due to
1480 lack of memory or when the process frees dynamically allocated
1481 memory. For a process which started during the last interval,
1482 the resident growth reflects the total resident size of the
1483 process at that moment.
1484 If a process has finished during the last interval, no value
1485 is shown since resident memory occupation is not part of the
1486 standard process accounting record.
1487 RNET The number of TCP- and UDP packets received by this process.
1489 This information will only be shown when kernel module 'ne‐
1490 tatop' is installed.
1491 If a process has finished during the last interval, no value
1492 is shown since network counters are not part of the standard
1493 process accounting record.
1494 RSIZE The total resident memory usage consumed by this process (or
1496 user). Notice that the RSIZE of a process includes all resi‐
1497 dent memory used by that process, even if certain memory parts
1498 are shared with other processes (see also the explanation of
1499 PSIZE).
1500 If a process has finished during the last interval, no value
1501 is shown since resident memory occupation is not part of the
1502 standard process accounting record.
1503 RTPR Realtime priority according the POSIX standard. Value can be
1505 0 for a timesharing process (policy 'norm', 'btch' or 'idle')
1506 or ranges from 1 (lowest) till 99 (highest) for a realtime
1507 process (policy 'rr' or 'fifo').
1508 RUID The real user-id under which the process executes.
1510 S The current state of the (main) thread: 'R' for running (cur‐
1512 rently processing or in the runqueue), 'S' for sleeping inter‐
1513 ruptible (wait for an event to occur), 'D' for sleeping non-
1514 interruptible, 'Z' for zombie (waiting to be synchronized with
1515 its parent process), 'T' for stopped (suspended or traced),
1516 'W' for swapping, and 'E' (exit) for processes which have fin‐
1517 ished during the last interval.
1518 SGID The saved group-id of the process.
1520 SNET The number of TCP and UDP packets transmitted by this process.
1522 This information will only be shown when the kernel module
1523 'netatop' is loaded.
1524 ST The status of a process.
1526 The first position indicates if the process has been started
1527 during the last interval (the value N means 'new process').
1528 The second position indicates if the process has been finished
1530 during the last interval.
1531 The value E means 'exit' on the process' own initiative; the
1532 exit code is displayed in the column 'EXC'.
1533 The value S means that the process has been terminated unvol‐
1534 untarily by a signal; the signal number is displayed in the in
1535 the column 'EXC'.
1536 The value C means that the process has been terminated unvol‐
1537 untarily by a signal, producing a core dump in its current di‐
1538 rectory; the signal number is displayed in the column 'EXC'.
1539 STDATE The start date of the process.
1541 STTIME The start time of the process.
1543 SUID The saved user-id of the process.
1545 SWPMAX The 'memory.swap.max' value of the cgroup (version 2) to which
1547 this process belongs.
1548 SWAPSZ The swap space consumed by this process (or user).
1550 SWMAXR The most restrictive (i.e. effective) 'memory.swap.max' value
1552 defined by the upper directories of the cgroup (version 2) to
1553 which this process belongs.
1554 SYSCPU CPU time consumption of this process in system mode (kernel
1556 mode), usually due to system call handling.
1557 TCPRASZ The average size of a received TCP buffer in bytes. This in‐
1559 formation will only be shown when the kernel module 'netatop'
1560 is loaded.
1561 TCPRCV The number of TCP packets received for this process. This in‐
1563 formation will only be shown when the kernel module 'netatop'
1564 is loaded.
1565 TCPSASZ The average size of a transmitted TCP buffer in bytes. This
1567 information will only be shown when the kernel module 'ne‐
1568 tatop' is loaded.
1569 TCPSND The number of TCP packets transmitted for this process. This
1571 information will only be shown when the kernel module 'ne‐
1572 tatop' is loaded.
1573 THR Total number of threads within this process. All related
1575 threads are contained in a thread group, represented by atop
1576 as one line or as a separate line when the 'y' key (or -y
1577 flag) is active.
1578 On Linux 2.4 systems it is hardly possible to determine which
1580 threads (i.e. processes) are related to the same thread group.
1581 Every thread is represented by atop as a separate line.
1582 TID Thread-id. All threads within a process run with the same PID
1584 but with a different TID. This value is shown for individual
1585 threads in multi-threaded processes (when using the key 'y').
1586 TRUN Number of threads within this process that are in the state
1588 'running' (R).
1589 TSLPI Number of threads within this process that are in the state
1591 'interruptible sleeping' (S).
1592 TSLPU Number of threads within this process that are in the state
1594 'uninterruptible sleeping' (D).
1595 UDPRASZ The average size of a received UDP packet in bytes. This in‐
1597 formation will only be shown when the kernel module 'netatop'
1598 is loaded.
1599 UDPRCV The number of UDP packets received by this process. This in‐
1601 formation will only be shown when the kernel module 'netatop'
1602 is loaded.
1603 UDPSASZ The average size of a transmitted UDP packets in bytes. This
1605 information will only be shown when the kernel module 'ne‐
1606 tatop' is loaded.
1607 UDPSND The number of UDP packets transmitted by this process. This
1609 information will only be shown when the kernel module 'ne‐
1610 tatop' is loaded.
1611 USRCPU CPU time consumption of this process in user mode, due to pro‐
1613 cessing the own program text.
1614 VDATA The virtual memory size of the private data used by this
1616 process (including heap and shared library data).
1617 VGROW The amount of virtual memory that the process has grown during
1619 the last interval. A virtual growth can be caused by e.g. is‐
1620 suing a malloc() or attaching a shared memory segment. Note
1621 that a virtual growth can also be negative by e.g. issuing a
1622 free() or detaching a shared memory segment. For a process
1623 which started during the last interval, the virtual growth re‐
1624 flects the total virtual size of the process at that moment.
1625 If a process has finished during the last interval, no value
1626 is shown since virtual memory occupation is not part of the
1627 standard process accounting record.
1628 VPID Virtual process-id (within an OpenVZ container). If a process
1630 has been started and finished during the last interval, a '?'
1631 is shown because the virtual process-id is not part of the
1632 standard process accounting record.
1633 VSIZE The total virtual memory usage consumed by this process (or
1635 user).
1636 If a process has finished during the last interval, no value
1637 is shown since virtual memory occupation is not part of the
1638 standard process accounting record.
1639 VSLIBS The virtual memory size of the (shared) text of all shared li‐
1641 braries used by this process.
1642 VSTACK The virtual memory size of the (private) stack used by this
1644 process
1645 VSTEXT The virtual memory size of the (shared) text of the executable
1647 program.
1648 WCHAN Wait channel of thread in sleep state, i.e. the name of the
1650 kernel function in which the thread has been put asleep.
1651 Since determining the name string of the kernel function is a
1652 relatively time-consuming task, the 'W' key (or '-W' flag)
1653 should be active.
1654 WRDSK The write data transfer issued physically on disk (so writing
1656 to the disk cache is not accounted for). This counter is
1657 maintained for the application process that writes its data to
1658 the cache (assuming that this data is physically transferred
1659 to disk later on). Notice that disk I/O needed for swapping is
1660 not taken into account.
1661 Unfortunately, the kernel aggregates the data transfer of a
1662 process to the data transfer of its parent process when termi‐
1663 nating, so you might see transfers for (parent) processes like
1664 cron, bash or init, that are not really issued by them.
1665 WCANCL The write data transfer previously accounted for this process
1667 or another process that has been cancelled. Suppose that a
1668 process writes new data to a file and that data is removed
1669 again before the cache buffers have been flushed to disk.
1670 Then the original process shows the written data as WRDSK,
1671 while the process that removes/truncates the file shows the
1672 unflushed removed data as WCANCL.
1673
1675 With the flag -P followed by a list of one or more labels (comma-sepa‐
1676 rated), parsable output is produced for each sample. The labels that
1677 can be specified for system-level statistics correspond to the labels
1678 (first verb of each line) that can be found in the interactive output:
1679 "CPU", "cpu", "CPL", "GPU", "MEM", "SWP", "PAG", "PSI", "LVM", "MDD",
1680 "DSK", "NFM", "NFC", "NFS", "NET", "IFB", "LLC", "NUM" and "NUC".
1681 For process-level statistics special labels are available: "PRG" (gen‐
1682 eral), "PRC" (CPU), "PRE" (GPU), "PRM" (memory), "PRD" (disk, only if
1683 "storage accounting" is active) and "PRN" (network, only if the kernel
1684 module 'netatop' has been installed).
1685 With the label "ALL", all system and process level statistics are
1686 shown.
1687 The command and command line in the parsable output might contain spa‐
1689 ces and are therefore by default surrounded by parenthesis. However,
1690 since a space is often used as separator between the fields by parsing
1691 tools, with the additional flag -Z it is possible to exchange the spa‐
1692 ces in the command (line) by underscores and omit the parenthesis.
1693 For every interval all requested lines are shown whereafter atop shows
1695 a line just containing the label "SEP" as a separator before the lines
1696 for the next sample are generated.
1697 When a sample contains the values since boot, atop shows a line just
1698 containing the label "RESET" before the lines for this sample are gen‐
1699 erated.
1700 The first part of each output-line consists of the following six
1702 fields: label (the name of the label), host (the name of this machine),
1703 epoch (the time of this interval as number of seconds since 1-1-1970),
1704 date (date of this interval in format YYYY/MM/DD), time (time of this
1705 interval in format HH:MM:SS), and interval (number of seconds elapsed
1706 for this interval).
1707 The subsequent fields of each output-line depend on the label:
1709 CPU Subsequent fields: total number of clock-ticks per second for
1711 this machine, number of processors, consumption for all CPUs
1712 in system mode (clock-ticks), consumption for all CPUs in user
1713 mode (clock-ticks), consumption for all CPUs in user mode for
1714 niced processes (clock-ticks), consumption for all CPUs in
1715 idle mode (clock-ticks), consumption for all CPUs in wait mode
1716 (clock-ticks), consumption for all CPUs in irq mode (clock-
1717 ticks), consumption for all CPUs in softirq mode (clock-
1718 ticks), consumption for all CPUs in steal mode (clock-ticks),
1719 consumption for all CPUs in guest mode (clock-ticks) overlap‐
1720 ping user mode, frequency of all CPUs, frequency percentage of
1721 all CPUs, instructions executed by all CPUs and cycles for all
1722 CPUs.
1723 cpu Subsequent fields: total number of clock-ticks per second for
1725 this machine, processor-number, consumption for this CPU in
1726 system mode (clock-ticks), consumption for this CPU in user
1727 mode (clock-ticks), consumption for this CPU in user mode for
1728 niced processes (clock-ticks), consumption for this CPU in
1729 idle mode (clock-ticks), consumption for this CPU in wait mode
1730 (clock-ticks), consumption for this CPU in irq mode (clock-
1731 ticks), consumption for this CPU in softirq mode (clock-
1732 ticks), consumption for this CPU in steal mode (clock-ticks),
1733 consumption for this CPU in guest mode (clock-ticks) overlap‐
1734 ping user mode, frequency of this CPU, frequency percentage of
1735 this CPU, instructions executed by this CPU and cycles for
1736 this CPU.
1737 CPL Subsequent fields: number of processors, load average for last
1739 minute, load average for last five minutes, load average for
1740 last fifteen minutes, number of context-switches, and number
1741 of device interrupts.
1742 GPU Subsequent fields: GPU number, bus-id string, type of GPU
1744 string, GPU busy percentage during last second (-1 if not
1745 available), memory busy percentage during last second (-1 if
1746 not available), total memory size (KiB), used memory (KiB) at
1747 this moment, number of samples taken during interval, cumula‐
1748 tive GPU busy percentage during the interval (to be divided by
1749 the number of samples for the average busy percentage, -1 if
1750 not available), cumulative memory busy percentage during the
1751 interval (to be divided by the number of samples for the aver‐
1752 age busy percentage, -1 if not available), and cumulative mem‐
1753 ory occupation during the interval (to be divided by the num‐
1754 ber of samples for the average occupation).
1755 MEM Subsequent fields: page size for this machine (in bytes), size
1757 of physical memory (pages), size of free memory (pages), size
1758 of page cache (pages), size of buffer cache (pages), size of
1759 slab (pages), dirty pages in cache (pages), reclaimable part
1760 of slab (pages), total size of vmware's balloon pages (pages),
1761 total size of shared memory (pages), size of resident shared
1762 memory (pages), size of swapped shared memory (pages), huge
1763 page size (in bytes), total size of huge pages (huge pages),
1764 size of free huge pages (huge pages), size of ARC (cache) of
1765 ZFSonlinux (pages), size of sharing pages for KSM (pages),
1766 size of shared pages for KSM (pages), size of memory used for
1767 TCP sockets (pages), size of memory used for UDP sockets
1768 (pages), and size of pagetables (pages).
1769 SWP Subsequent fields: page size for this machine (in bytes), size
1771 of swap (pages), size of free swap (pages), size of swap cache
1772 (pages), size of committed space (pages), limit for committed
1773 space (pages), size of the swap cache (pages), size of com‐
1774 pressed pages stored in zswap (pages), and total size of com‐
1775 pressed pool in zswap (pages).
1776 LLC Subsequent fields: LLC id, percentage of LLC in use, total
1778 memory bandwidth of this LLC (in bytes), and memory bandwidth
1779 on local NUMA node of this LLC (in bytes).
1780 PAG Subsequent fields: page size for this machine (in bytes), num‐
1782 ber of page scans, number of allocstalls, 0 (future use), num‐
1783 ber of swapins, number of swapouts, number of oomkills (-1
1784 when counter not present), number of process stalls to run
1785 memory compaction, number of pages successfully migrated in
1786 total, number of NUMA pages migrated, number of pages read
1787 from block devices, and number of pages written to block de‐
1788 vices.
1789 PSI Subsequent fields: PSI statistics present on this system (n or
1791 y), CPU some avg10, CPU some avg60, CPU some avg300, CPU some
1792 accumulated microseconds during interval, memory some avg10,
1793 memory some avg60, memory some avg300, memory some accumulated
1794 microseconds during interval, memory full avg10, memory full
1795 avg60, memory full avg300, memory full accumulated microsec‐
1796 onds during interval, I/O some avg10, I/O some avg60, I/O some
1797 avg300, I/O some accumulated microseconds during interval, I/O
1798 full avg10, I/O full avg60, I/O full avg300, and I/O full ac‐
1799 cumulated microseconds during interval.
1800 LVM/MDD/DSK
1802 For every logical volume/multiple device/hard disk one line is
1803 shown.
1804 Subsequent fields: name, number of milliseconds spent for I/O,
1805 number of reads issued, number of sectors transferred for
1806 reads, number of writes issued, number of sectors transferred
1807 for write, number of discards issued (-1 if not supported),
1808 number of sectors transferred for discards, number of requests
1809 currently in flight (not yet completed), and the average queue
1810 depth while the disk was busy.
1811 NFM Subsequent fields: mounted NFS filesystem, total number of
1813 bytes read, total number of bytes written, number of bytes
1814 read by normal system calls, number of bytes written by normal
1815 system calls, number of bytes read by direct I/O, number of
1816 bytes written by direct I/O, number of pages read by memory-
1817 mapped I/O, and number of pages written by memory-mapped I/O.
1818 NFC Subsequent fields: number of transmitted RPCs, number of
1820 transmitted read RPCs, number of transmitted write RPCs, num‐
1821 ber of RPC retransmissions, and number of authorization re‐
1822 freshes.
1823 NFS Subsequent fields: number of handled RPCs, number of received
1825 read RPCs, number of received write RPCs, number of bytes read
1826 by clients, number of bytes written by clients, number of RPCs
1827 with bad format, number of RPCs with bad authorization, number
1828 of RPCs from bad client, total number of handled network re‐
1829 quests, number of handled network requests via TCP, number of
1830 handled network requests via UDP, number of handled TCP con‐
1831 nections, number of hits on reply cache, number of misses on
1832 reply cache, and number of uncached requests.
1833 NET First, one line is produced for the upper layers of the TCP/IP
1835 stack.
1836 Subsequent fields: the verb "upper", number of packets re‐
1837 ceived by TCP, number of packets transmitted by TCP, number of
1838 packets received by UDP, number of packets transmitted by UDP,
1839 number of packets received by IP, number of packets transmit‐
1840 ted by IP, number of packets delivered to higher layers by IP,
1841 number of packets forwarded by IP, number of input errors
1842 (UDP), number of noport errors (UDP), number of active opens
1843 (TCP), number of passive opens (TCP), number of passive opens
1844 (TCP), number of established connections at this moment (TCP),
1845 number of retransmitted segments (TCP), number of input errors
1846 (TCP), and number of output resets (TCP).
1847 Next, one line is shown for every interface.
1849 Subsequent fields: name of the interface, number of packets
1850 received by the interface, number of bytes received by the in‐
1851 terface, number of packets transmitted by the interface, num‐
1852 ber of bytes transmitted by the interface, interface speed,
1853 and duplex mode (0=half, 1=full).
1854 IFB Subsequent fields: name of the InfiniBand interface, port num‐
1856 ber, number of lanes, maximum rate (Mbps), number of bytes re‐
1857 ceived, number of bytes transmitted, number of packets re‐
1858 ceived, and number of packets transmitted.
1859 NUM Subsequent fields: NUMA node number, page size for this ma‐
1861 chine (in bytes), the fragmentation percentage of this node,
1862 size of physical memory (pages), size of free memory (pages),
1863 recently (active) used memory (pages), less recently (inac‐
1864 tive) used memory (pages), size of cached file data (pages),
1865 dirty pages in cache (pages), slab memory being used for ker‐
1866 nel mallocs (pages), slab memory that is reclaimable (pages),
1867 shared memory including tmpfs (pages), and total huge pages
1868 (pages).
1869 NUC Subsequent fields: NUMA node number, number of processors for
1871 this node, consumption for node CPUs in system mode (clock-
1872 ticks), consumption for node CPUs in user mode (clock-ticks),
1873 consumption for node CPUs in user mode for niced processes
1874 (clock-ticks), consumption for node CPUs in idle mode (clock-
1875 ticks), consumption for node CPUs in wait mode (clock-ticks),
1876 consumption for node CPUs in irq mode (clock-ticks), consump‐
1877 tion for node CPUs in softirq mode (clock-ticks), consumption
1878 for node CPUs in steal mode (clock-ticks), and consumption for
1879 node CPUs in guest mode (clock-ticks) overlapping user mode.
1880 PRG For every process one line is shown.
1882 Subsequent fields: PID (unique ID of task), name (between
1883 parenthesis or underscores for spaces), state, real uid, real
1884 gid, TGID (group number of related tasks/threads), total num‐
1885 ber of threads, exit code (in case of fatal signal: signal
1886 number + 256), start time (epoch), full command line (between
1887 parenthesis or underscores for spaces), PPID, number of
1888 threads in state 'running' (R), number of threads in state
1889 'interruptible sleeping' (S), number of threads in state 'un‐
1890 interruptible sleeping' (D), effective uid, effective gid,
1891 saved uid, saved gid, filesystem uid, filesystem gid, elapsed
1892 time of terminated process (hertz), is_process (y/n), OpenVZ
1893 virtual pid (VPID), OpenVZ container id (CTID), Docker con‐
1894 tainer id (CID), indication if the task is newly started dur‐
1895 ing this interval ('N'), cgroup v2 path name (between paren‐
1896 thesis or underscores for spaces), and end time (epoch or 0 if
1897 still active).
1898 PRC For every process one line is shown.
1900 Subsequent fields: PID, name (between parenthesis or under‐
1901 scores for spaces), state, total number of clock-ticks per
1902 second for this machine, CPU-consumption in user mode (clock‐
1903 ticks), CPU-consumption in system mode (clockticks), nice
1904 value, priority, realtime priority, scheduling policy, current
1905 CPU (-1 for exited process), sleep average, TGID (group number
1906 of related tasks/threads), is_process (y/n), runqueue delay in
1907 nanoseconds for this thread or for all threads (in case of
1908 process), wait channel of this thread (between parenthesis or
1909 underscores for spaces), block I/O delay (clockticks), cgroup
1910 v2 'cpu.max' calculated as percentage (-3 means no cgroup v2
1911 support, -2 means undefined and -1 means maximum), cgroup v2
1912 most restrictive 'cpu.max' in upper directories calculated as
1913 percentage (-3 means no cgroup v2 support, -2 means undefined
1914 and -1 means maximum), number of voluntary context switches,
1915 and number of involuntary context switches.
1916 PRE For every process one line is shown.
1918 Subsequent fields: PID, name (between parenthesis or under‐
1919 scores for spaces), process state, GPU state (A for active, E
1920 for exited, N for no GPU user), number of GPUs used by this
1921 process, bitlist reflecting used GPUs, GPU busy percentage
1922 during interval, memory busy percentage during interval, mem‐
1923 ory occupation (KiB) at this moment cumulative memory occupa‐
1924 tion (KiB) during interval, and number of samples taken during
1925 interval.
1926 PRM For every process one line is shown.
1928 Subsequent fields: PID, name (between parenthesis or under‐
1929 scores for spaces), state, page size for this machine (in
1930 bytes), virtual memory size (KiB), resident memory size (KiB),
1931 shared text memory size (KiB), virtual memory growth (KiB),
1932 resident memory growth (KiB), number of minor page faults,
1933 number of major page faults, virtual library exec size (KiB),
1934 virtual data size (KiB), virtual stack size (KiB), swap space
1935 used (KiB), TGID (group number of related tasks/threads),
1936 is_process (y/n), proportional set size (KiB) if in 'R' option
1937 is specified, virtually locked memory space (KiB), cgroup v2
1938 'memory.max' in KiB (-3 means no cgroup v2 support, -2 means
1939 undefined and -1 means maximum), cgroup v2 most restrictive
1940 'memory.max' in upper directories in KiB (-3 means no cgroup
1941 v2 support, -2 means undefined and -1 means maximum), cgroup
1942 v2 'memory.swap.max' in KiB (-3 means no cgroup v2 support, -2
1943 means undefined and -1 means maximum), and cgroup v2 most re‐
1944 strictive 'memory.swap.max' in upper directories in KiB (-3
1945 means no cgroup v2 support, -2 means undefined and -1 means
1946 maximum).
1947 PRD For every process one line is shown.
1949 Subsequent fields: PID, name (between parenthesis or under‐
1950 scores for spaces), state, obsoleted kernel patch installed
1951 ('n'), standard io statistics used ('y' or 'n'), number of
1952 reads on disk, cumulative number of sectors read, number of
1953 writes on disk, cumulative number of sectors written, can‐
1954 celled number of written sectors, TGID (group number of re‐
1955 lated tasks/threads), obsoleted value ('n'), and is_process
1956 (y/n).
1957 PRN For every process one line is shown.
1959 Subsequent fields: PID, name (between parenthesis or under‐
1960 scores for spaces), state, kernel module 'netatop' loaded ('y'
1961 or 'n'), number of TCP-packets transmitted, cumulative size of
1962 TCP-packets transmitted, number of TCP-packets received, cumu‐
1963 lative size of TCP-packets received, number of UDP-packets
1964 transmitted, cumulative size of UDP-packets transmitted, num‐
1965 ber of UDP-packets received, cumulative size of UDP-packets
1966 transmitted, number of raw packets transmitted (obsolete, al‐
1967 ways 0), number of raw packets received (obsolete, always 0),
1968 TGID (group number of related tasks/threads) and is_process
1969 (y/n).
1970 If the kernel module is not active, the network I/O counters
1971 per process are not relevant.
1972
1974 With the flag -J followed by a list of one or more labels (comma-sepa‐
1975 rated), JSON output is produced for each sample. The syntax and name of
1976 JSON labels are the same as for the parsable output.
1977
1979 By sending the SIGUSR1 signal to atop a new sample will be forced, even
1980 if the current timer interval has not exceeded yet. The behavior is
1981 similar to pressing the 't' key in an interactive session.
1982 By sending the SIGUSR2 signal to atop a final sample will be forced af‐
1984 ter which atop will terminate.
1985
1987 To monitor the current system load in text mode with an interval of
1988 (default) 10 seconds:
1989 atop
1991 To monitor the current system load as bar graphs with an interval of 5
1993 seconds:
1994 atop -B 5
1996 Store information about the system and process activity in binary com‐
1998 pressed form to a file with an interval of ten minutes during an hour:
1999 atop -w /tmp/atop.raw 600 6
2001 View the contents of this file interactively:
2003 atop -r /tmp/atop.raw
2005 View the processor and disk utilization of this file in parsable for‐
2007 mat:
2008 atop -PCPU,DSK -r /tmp/atop.raw
2010 View the contents of today's standard logfile interactively:
2012 atop -r
2014 View the contents of the standard logfile of the day before yesterday
2016 interactively:
2017 atop -r yy
2019 View the contents of the standard logfile of 2023, April 15 from 02:00
2021 PM onwards interactively:
2022 atop -r 20230415 -b 1400
2024 Concatenate all raw log files of March 2023 and generate parsable out‐
2026 put about the CPU utilization:
2027 atopcat /var/log/atop/atop_202303?? | atop -r - -PCPU
2029 To monitor the system load and write it to a file (in plain ASCII) with
2031 an interval of one minute during half an hour with active processes
2032 sorted on memory consumption:
2033 atop -M 60 30 > /log/atop.mem
2035
2037 /var/run/pacct_shadow.d/
2038 Directory containing the process accounting shadow files that are
2039 used by atop when the atopacctd daemon is active.
2040 /var/cache/atop.d/atop.acct
2042 File in which the kernel writes the accounting records when atop
2043 itself has activated the process accounting mechanism.
2044 /etc/atoprc
2046 Configuration file containing system-wide default values. For
2047 further information about the default values, refer to the atoprc
2048 man page).
2049 ~/.atoprc
2051 Configuration file containing personal default values. For fur‐
2052 ther information about the default values, refer to the atoprc man
2053 page).
2054 /etc/default/atop
2056 Configuration file to overrule the settings of atop that runs in
2057 the background to create the daily logfile. This file is created
2058 when atop is installed. The default settings are:
2059 LOGOPTS=""
2061 LOGINTERVAL=600
2062 LOGGENERATIONS=28
2063 /var/log/atop/atop_YYYYMMDD
2065 Raw file, where YYYYMMDD are digits representing the current date.
2066 This name is used by atop running in the background as default
2067 name for the output file, and by atop as default name for the in‐
2068 put file when using the -r flag.
2069 All binary system and process level data in this file has been
2070 stored in compressed format.
2071 /var/run/netatop.log
2073 File that contains the netpertask structs containing the network
2074 counters of exited processes. These structs are written by the ne‐
2075 tatopd daemon and read by atop after reading the standard process
2076 accounting records.
2077
2079 atopsar(1), atopconvert(1), atopcat(1), atoprc(5), atopacctd(8), ne‐
2080 tatop(4), netatopd(8), atopgpud(8), logrotate(8)
2081 https://www.atoptool.nl
2082
2084 Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
2085 JC van Winkel
2086Linux April 2023 ATOP(1)