NAME
atop - AT Computing’s System & Process Monitor
SYNOPSIS
Interactive usage:
atop [-g|-m|-d|-n|-u|-p|-s|-c|-v] [-C|-M|-D|-N|-A] [-af1x]
[-Plabel[,label]...] [ interval [ samples ]]
Writing and reading raw logfiles:
atop -w rawfile [-a] [-S] [ interval [ samples ]]
atop -r [ rawfile ] [-b hh:mm ] [-e hh:mm ]
[-g|-m|-d|-n|-u|-p|-s|-c|-v] [-C|-M|-D|-N|-A] [-f1x]
[-Plabel[,label]...]
DESCRIPTION
The program atop is an interactive monitor to view the load on a Linux
system. It shows the occupation of the most critical hardware
resources (from a performance point of view) on system level, i.e. cpu,
memory, disk and network.
It also shows which processes are responsible for the indicated load
with respect to cpu- and memory load on process level; disk- and
network load is only shown per process if a kernel patch has been
installed.
Every interval (default: 10 seconds) information is shown about the
resource occupation on system level (cpu, memory, disks and network
layers), followed by a list of processes which have been active during
the last interval (note that all processes that were unchanged during
the last interval are not shown, unless the key ’a’ has been pressed).
If the list of active processes does not entirely fit on the screen,
only the top of the list is shown (sorted in order of activity).
The intervals are repeated till the number of samples (specified as
command argument) is reached, or till the key ’q’ is pressed in
interactive mode.
When atop is started, it checks whether the standard output channel is
connected to a screen, or to a file/pipe. In the first case it produces
screen control codes (via the curses library) and behaves
interactively; in the second case it produces flat ASCII-output.
In interactive mode, the output of atop can be controlled by pressing
particular keys. However it is also possible to specify such key as
flag on the command line. In the latter case atop will switch to the
indicated mode on beforehand; this mode can be modified again
interactively. Specifying such key as flag is especially useful when
running atop with output to a pipe or file (non-interactively). The
flags used are the same as the keys which can be pressed in interactive
mode (see section INTERACTIVE COMMANDS).
Additional flags are available to support storage of atop-data in raw
format (see section RAW DATA STORAGE).
PROCESS ACCOUNTING
When atop is started, it switches on the process accounting mechanism
in the kernel. This forces the kernel to write a record with accounting
information to the accounting file whenever a process ends. Apart from
the kernel administration related to the running processes, atop also
interprets the accounting records on disk with every interval; in this
way atop can also show the activity of a process during the interval in
which it is finished.
Whenever the last incarnation of atop stops (either by pressing ‘q’ or
by ‘kill -15’), it switches off the process accounting mechanism again.
You should never terminate atop by ‘kill -9’, because then it has no
chance to stop process accounting; as a result the accounting file may
consume a lot of disk space after a while.
With the environment variable ATOPACCT the name of a specific process
accounting file can be specified (accounting should have been activated
on beforehand). When this environment variable is present but its
contents is empty, process accounting will not be used at all.
COLORS
For the resource consumption on system level, atop uses colors to
indicate that a critical occupation percentage has been (almost)
reached. A critical occupation percentage means that is likely that
this load causes a noticable negative performance influence for
applications using this resource. The critical percentage depends on
the type of resource: e.g. the performance influence of a disk with a
busy percentage of 80% might be more noticable for applications/user
than a CPU with a busy percentage of 90%.
Currently atop uses the following default values to calculate a
weighted percentage per resource:
Processor
A busy percentage of 90% or higher is considered ‘critical’.
Disk
A busy percentage of 70% or higher is considered ‘critical’.
Network
A busy percentage of 90% or higher for the load of an interface is
considered ‘critical’.
Memory
An occupation percentage of 90% is considered ‘critical’. Notice
that this occupation percentage is the accumulated memory
consumption of the kernel (including slab) and all processes; the
memory for the page cache (‘cache’ and ‘buff’ in the MEM-line) is
not implied!
If the number of pages swapped out (‘swout’ in the PAG-line) is
larger than 10 per second, the memory resource is considered
‘critical’. A value of at least 1 per second is considered
‘almost critical’.
If the committed virtual memory exceeds the limit (‘vmcom’ and
‘vmlim’ in the SWP-line), the SWP-line is colored due to
overcommitting the system.
Swap
An occupation percentage of 80% is considered ‘critical’ because
swap space might be completely exhausted in the near future; it is
not critical from a performance point-of-view.
These default values can be modified in the configuration file (see
section CONFIGURATION FILE).
When a resource exceeded its critical occupation percentage, the entire
screen line is colored red.
When a resource exceeded (default) 80% of its critical percentage (so
it is almost critical), the entire screen line is colored cyan. This
‘almost critical percentage’ (one value for all resources) can be
modified in the configuration file (see section CONFIGURATION FILE).
With the key ’x’ (or flag -x), line coloring can be suppressed.
INTERACTIVE COMMANDS
When running atop interactively (no output redirection), keys can be
pressed to control the output. In general, lower case keys can be used
to show other information for the active processes and upper case keys
can be used to influence the sort order of the active process list.
g Show generic output (default).
Per process the following fields are shown: process-id, cpu
consumption during the last interval in system- and user mode, the
virtual and resident memory growth of the process.
The subsequent columns depend on the used kernel: When the kernel
patch ‘cnt’ has been installed, the number of read- and write
transfers on disk, and the number of received and transmitted
network packets are shown for each process. When the kernel patch
is not installed and the kernel supports per-process io statistics
(>= 2.6.20), the data transfer for read/write on disk, the status
and exit code are shown for each process. When the kernel patch
is not installed and the kernel does not support per-process io
statistics, the username, number of threads in the thread group,
the status and exit code are shown.
The last columns contain the state, the occupation percentage for
the choosen resource (default: cpu) and the process name.
m Show memory related output.
Per process the following fields are shown: process-id, minor and
major memory faults, size of virtual shared text, total virtual
process size, total resident process size, virtual and resident
growth during last interval, memory occupation percentage and
process name.
d Show disk-related output.
Per process the following fields are shown: process-id, number of
physical disk reads, average size per read (bytes), total size for
read transfers, physical disk writes, average size per write
(bytes), total size for write transfers, disk occupation
percentage and process name.
This information can only be shown when kernel patch ‘cnt’ is
installed.
n Show network related output.
Per process the following fields are shown: process-id, number of
received TCP packets with the average size per packet (in bytes),
number of sent TCP packets with the average size per packet (in
bytes), number of received UDP packets with the average size per
packet (in bytes), number of sent UDP packets with the average
size per packet (in bytes), and received and send raw packets
(e.g. ICMP) in one column, the network occupation percentage and
process name.
This information can only be shown when kernel patch ‘cnt’ is
installed.
s Show scheduling characteristics.
Per process the following fields are shown: process-id, number of
threads in state ’running’ (R), number of threads in state
’interruptible sleeping’ (S), number of threads in state
’uninterruptible sleeping’ (D), scheduling policy (normal
timesharing, realtime round-robin, realtime fifo), nice value,
priority, realtime priority, current processor, status, exit code,
state, the occupation percentage for the choosen resource and the
process name.
v Show various process characteristics.
Per process the following fields are shown: process-id, user name
and group, start date and time, status (e.g. exit code if the
process has finished), state, the occupation percentage for the
choosen resource and the process name.
c Show the command line of the process.
Per process the following fields are shown: process-id, the
occupation percentage for the choosen resource and the command
line including arguments.
u Show the process activity accumulated per user.
Per user the following fields are shown: number of processes
active or terminated during last interval (or in total if combined
with command ‘a’), accumulated cpu consumption during last
interval in system- and user mode, the current virtual and
resident memory space consumed by active processes (or all
processes of the user if combined with command ‘a’).
When the kernel patch ‘cnt’ has been installed, the accumulated
number of read- and write transfers on disk, and the number of
received and sent network packets are shown. When the kernel patch
is not installed, these counters are zero.
The last columns contain the accumulated occupation percentage for
the choosen resource (default: cpu) and the user name.
p Show the process activity accumulated per program (i.e. process
name).
Per program the following fields are shown: number of processes
active or terminated during last interval (or in total if combined
with command ‘a’), accumulated cpu consumption during last
interval in system- and user mode, the current virtual and
resident memory space consumed by active processes (or all
processes of the user if combined with command ‘a’).
When the kernel patch ‘cnt’ has been installed, the accumulated
number of read- and write transfers on disk, and the number of
received and sent network packets are shown. When the kernel patch
is not installed, these counters are zero.
The last columns contain the accumulated occupation percentage for
the choosen resource (default: cpu) and the program name.
C Sort the current list in the order of cpu consumption (default).
The one-but-last column changes to ‘‘CPU’’.
M Sort the current list in the order of resident memory consumption.
The one-but-last column changes to ‘‘MEM’’.
D Sort the current list in the order of disk accesses issued. The
one-but-last column changes to ‘‘DSK’’.
N Sort the current list in the order of network packets
received/transmitted. The one-but-last column changes to ‘‘NET’’.
A Sort the current list automatically in the order of the most busy
system resource during this interval. The one-but-last column
shows either ‘‘ACPU’’, ‘‘AMEM’’, ‘‘ADSK’’ or ‘‘ANET’’ (the
preceding ’A’ indicates automatic sorting-order). The most busy
resource is determined by comparing the weighted busy-percentages
of the system resources, as described earlier in the section
COLORS.
This option remains valid until another sorting-order is
explicitly selected again.
A sorting-order for disk or network is only possible when kernel
patch ‘cnt’ is installed.
Miscellaneous interactive commands:
? Request for help information (also the key ’h’ can be pressed).
V Request for version information (version number and date).
x Use colors to highlight critical resources (toggle).
z The pause key can be used to freeze the current situation in order
to investigate the output on the screen. While atop is paused, the
keys described above can be pressed to show other information
about the current list of processes. Whenever the pause key is
pressed again, atop will continue with a next sample.
i Modify the interval timer (default: 10 seconds). If an interval
timer of 0 is entered, the interval timer is switched off. In that
case a new sample can only be triggered manually by pressing the
key ’t’.
t Trigger a new sample manually. This key can be pressed if the
current sample should be finished before the timer has exceeded,
or if no timer is set at all (interval timer defined as 0). In the
latter case atop can be used as a stopwatch to measure the load
being caused by a particular application transaction, without
knowing on beforehand how many seconds this transaction will last.
When viewing the contents of a raw file, this key can be used to
show the next sample from the file.
T When viewing the contents of a raw file, this key can be used to
show the previous sample from the file.
r Reset all counters to zero to see the system and process activity
since boot again.
When viewing the contents of a raw file, this key can be used to
rewind to the beginning of the file again.
U Specify a search string for specific user names as a regular
expression. From now on, only (active) processes will be shown
from a user which matches the regular expression. The system
statistics are still system wide. If the Enter-key is pressed
without specifying a name, active processes of all users will be
shown again.
P Specify a search string for specific process names as a regular
expression. From now on, only processes will be shown with a name
which matches the regular expression. The system statistics are
still system wide. If the Enter-key is pressed without specifying
a name, all active processes will be shown again.
a The ‘all/active’ key can be used to toggle between only
showing/accumulating the processes that were active during the
last interval (default) or showing/accumulating all processes.
f Fixate the number of lines for system resources (toggle). By
default only the lines are shown about system resources (cpu,
paging, disk, network) that really have been active during the
last interval. With this key you can force atop to show lines of
inactive resources as well.
1 Show relevant counters as an average per second (in the format
‘..../s’) instead of as a total during the interval (toggle).
l Limit the number of system level lines for the counters per-cpu,
the active disks and the network interfaces. By default lines are
shown of all cpu’s, disks and network interfaces which have been
active during the last interval. Limiting these lines can be
useful on systems with huge number cpu’s, disks or interfaces in
order to be able to run atop on a screen/window with e.g. only 24
lines.
For all mentioned resources the maximum number of lines can be
specified interactively. When using the flag -l the maximum number
of per-cpu lines is set to 0, the maximum number of disk lines to
5 and the maximum number of interface lines to 3. These values
can be modified again in interactive mode.
k Send a signal to an active process (aka kill a process).
q Quit the monitor program.
^F Show the next page of the process list (forward).
^B Show the previous page of the process list (backward).
RAW DATA STORAGE
In order to store system- and process level statistics for long-term
analysis (e.g. to check the system load and the active processes
running yesterday between 3:00 and 4:00 PM), atop can store the system-
and process level statistics in compressed binary format in a raw file
with the flag -w followed by the filename. If this file already exists
and is recognized as a raw data file, atop will append new samples to
the file (starting with a sample which reflects the activity since
boot); if the file does not exist, it will be created.
By default only processes which have been active during the interval
are stored in the raw file. When the flag -a is specified, all
processes will be stored.
The interval (default: 10 seconds) and number of samples (default:
infinite) can be passed as last arguments. Instead of the number of
samples, the flag -S can be used to indicate that atop should finish
anyhow before midnight.
A raw file can be read and visualized again with the flag -r followed
by the filename. If no filename is specified, the file
/var/log/atop.log is opened for input. If a filename is specified in
the format yyyymmdd (where yyyymmdd are digits representing any valid
date), the file /var/log/atop/atop_yyyymmdd is opened.
The samples from the file can be viewed interactively by using the key
’t’ to show the next sample and the key ’T’ to show the previous
sample. When output is redirected to a file or pipe, atop prints all
samples in plain ASCII.
With the flag -b (begin time) and/or -e (end time) followed by a time
argument of the form HH:MM, a certain time period within the raw file
can be selected.
The Debian package automatically starts up atop via init, rotation of
the logfiles is done with logrotate. Therefore, the suggested layout
with cron scripts in /etc/atop as described in the upstream package is
not necessary for Debian.
OUTPUT DESCRIPTION
The first sample shows the system level activity since boot (the
elapsed time in the header shows the number of seconds since boot).
Note that particular counters could have reached their maximum value
(several times) and started by zero again, so do not rely on these
figures.
For every sample atop first shows the lines related to system level
activity. If a particular system resource has not been used during the
interval, the entire line related to this resource is suppressed. So
the number of system level lines may vary for each sample.
After that a list is shown of processes which have been active during
the last interval. This list is by default sorted on cpu consumption,
but this order can be changed by the keys which are previously
described.
If values have to be shown by atop which do not fit in the column
width, another notation is used. If e.g. a cpu-consumption of 233216
milliseconds should be shown in a column width of 4 positions, it is
shown as ‘233s’ (in seconds). For large memory figures, another unit
is chosen if the value does not fit (Mb instead of Kb, Gb instead of
Mb). For other values, a kind of exponent notation is used (value
123456789 shown in a column of 5 positions gives 123e6).
The system level information consists of the following output lines:
PRC Process level totals.
This line contains the total cpu time consumed in system mode
(‘sys’) and in user mode (‘user’), the total number of processes
present at this moment (‘#proc’), the number of zombie processes
(‘#zombie’) and the number of processes that ended during the
interval (‘#exit’, which shows ‘?’ if process accounting is not
used).
CPU CPU utilization.
At least one line is shown for the total occupation of all CPU’s
together.
In case of a multi-processor system, an additional line is shown
for every individual processor (with ‘cpu’ in lower case), sorted
on activity. Inactive cpu’s will not be shown by default. The
lines showing the per-cpu occupation contain the cpu number in the
last field.
Every line contains the percentage of cpu time spent in kernel
mode by all active processes (‘sys’), the percentage of cpu time
consumed in user mode (‘user’) for all active processes (including
processes running with a nice value larger than zero), the
percentage of cpu time spent for interrupt handling (‘irq’)
including softirq, the percentage of unused cpu time while no
processes were waiting for disk-I/O (‘idle’), and the percentage
of unused cpu time while at least one process was waiting for
disk-I/O (‘wait’).
In case of per-cpu occupation, the last column shows the cpu
number and the wait percentage (‘w’) for that cpu. The number of
lines showing the per-cpu occupation can be limited.
For virtual machines a second line labelled ‘CPU’ is shown as an
extension of the first line. This second line contains the steal-
percentage for all processors (‘steal’) completing the categories
shown in the first line (‘sys‘, ‘user‘, ‘irq’, ‘idle’ and ‘wait’).
It concerns the percentage of cpu time stolen by other virtual
machines running on the same hardware. Furthermore the average
steal-percentage per processor is shown (‘stl/cpu’). For single-
processor systems this percentage is equal to the overall steal-
percentage.
CPL CPU load information.
This line contains the load average figures reflecting the number
of threads that are available to run on a CPU (i.e. part of the
runqueue) or that are waiting for disk I/O. These figures are
averaged over 1 (‘avg1’), 5 (‘avg5’) and 15 (‘avg15’) minutes.
Furthermore the number of context switches (‘csw’) and the number
of serviced interrupts (‘intr’) are shown.
MEM Memory occupation.
This line contains the total amount of physical memory (‘tot’),
the amount of memory which is currently free (‘free’), the amount
of memory in use as page cache (‘cache’), the amount of memory
used for filesystem meta data (‘buff’) and the amount of memory
being used for kernel malloc’s (‘slab’ - always 0 for kernel 2.4).
SWP Swap occupation and overcommit info.
This line contains the total amount of swap space on disk (‘tot’)
and the amount of free swap space (‘free’).
Furthermore the committed virtual memory space (‘vmcom’) and the
maximum limit of the committed space (‘vmlim’, which is by default
swap size plus 50% of memory size) is shown. The committed space
is the reserved virtual space for all allocations of private
memory space for processes. The kernel only verifies whether the
committed space exceeds the limit if strict overcommit handling is
configured (vm.overcommit_memory is 2).
PAG Paging frequency.
This line contains the number of scanned pages (‘scan’) due to the
fact that free memory drops below a particular threshold and the
number times that the kernel tries to reclaim pages due to an
urgent need (‘stall’).
Also the number of memory pages the system read from swap space
(‘swin’) and the number of memory pages the system wrote to swap
space (‘swout’) are shown.
DSK Disk utilization.
Per active disk one line is produced, sorted on disk activity.
Such line shows the name of the disk (e.g. hda or sda), the busy
percentage i.e. the portion of time that the disk was busy
handling requests (‘busy’), the number of read requests issued
(‘read’), the number of write requests issued (‘write’) and the
average number of milliseconds needed by a request (‘avio’) for
seek, latency and data transfer.
The number of lines showing the disk occupation can be limited.
NET Network utilization (TCP/IP).
One line is shown for activity of the transport layer (TCP and
UDP), one line for the IP layer and one line per active interface.
For the transport layer, counters are shown concerning the number
of received TCP segments including those received in error
(‘tcpi’), the number of transmitted TCP segments excluding those
containing only retransmitted octets (‘tcpo’), the number of UDP
datagrams received (‘udpi’) and the number of UDP datagrams
transmitted (‘udpo’). These counters are related to IPv4 and
IPv6.
For the IP layer, counters are shown concerning the number of IP
datagrams received from interfaces, including those received in
error (‘ipi’), the number of IP datagrams that local higher-layer
protocols offered for transmission (‘ipo’), the number of received
IP datagrams which were forwarded to other interfaces (‘ipfrw’)
and the number of IP datagrams which were delivered to local
higher-layer protocols (‘deliv’). These counters are related to
IPv4 and IPv6.
For every active network interface one line is shown, sorted on
the interface activity. Such line shows the name of the interface
and its busy percentage in the first column. The busy percentage
for half duplex is determined by comparing the interface speed
with the number of bits transmitted and received per second; for
full duplex the interface speed is compared with the highest of
either the transmitted or the received bits. When the interface
speed can not be determined (e.g. for the loopback interface),
‘---’ is shown instead of the percentage.
Furthermore the number of received packets (‘pcki’), the number of
transmitted packets (‘pcko’), the effective amount of bits
received per second (‘si’) and the effective amount of bits
transmitted per second (‘so’).
The number of lines showing the network interfaces can be limited.
Following the system level information, the processes are shown from
which the resource utilization has changed during the last interval.
These processes might have used cpu time or issued disk- or network
requests. However a process is also shown if part of it has been paged
out due to lack of memory (while the process itself was in sleep
state).
Per process the following fields may be shown (in alphabetical order),
depending on the current output mode as described in the section
INTERACTIVE COMMANDS:
CMD The name of the process. This name can be surrounded by
"less/greater than" signs (‘<name>’) which means that the
process has finished during the last interval.
Behind the abbreviation ‘CMD’ in the header line, the current
page number and the total number of pages of the process list
are shown.
COMMAND-LINE
The full command line of the process (including arguments),
which is limited to the length of the screen line. Th command
line can be surrounded by "less/greater than" signs (‘<line>’)
which means that the process has finished during the last
interval.
Behind the verb ‘COMMAND-LINE’ in the header line, the current
page number and the total number of pages of the process list
are shown.
CPU The occupation percentage of this process related to the
available capacity for this resource on system level.
DSK The occupation percentage of this process related to the total
load that is produced by all processes (i.e. total disk
accesses by all processes during the last interval).
This information can only be shown when kernel patch ‘cnt’ is
installed.
EXC The exit code of a terminated process (second position of
column ‘ST’ is E) or the fatal signal number (second position
of column ‘ST’ is S or C).
GROUP The real primary group identity under which the process runs.
MAJFLT The number of page faults issued by this process.
MEM The occupation percentage of this process related to the
available capacity for this resource on system level.
MINFLT The number of page reclaims issued by this process.
NET The occupation percentage of this process related to the total
load that is produced by all processes (i.e. network packets
transferred by all processes during the last interval).
This information can only be shown when kernel patch ‘cnt’ is
installed.
NPROCS The number of active and terminated processes accumulated for
this user or program.
PID Process-id. If a process has been started and finished during
the last interval, a ‘?’ is shown because the process-id is
not part of the standard process accounting record. However
when the kernel patch ‘acct’ is installed, this value will be
shown properly.
POLI Policy ’norm’ (normal, which is SCHED_OTHER) refers to a
timesharing process, ’fifo’ (SCHED_FIFO) and ’rr’ (round
robin, which is SCHED_RR) refer to a realtime process.
PPID Parent process-id. If a process has been started and finished
during the last interval, value 0 is shown because the parent
process-id is not part of the standard process accounting
record. However when the kernel patch ‘acct’ is installed,
this value will be shown properly.
PRI The process’ priority ranges from 0 (highest priority) to 139
(lowest priority). Priority 0 to 99 are used for realtime
processes (fixed priority independent of their behavior) and
priority 100 to 139 for timesharing processes (variable
priority depending on their recent CPU consumption and the
nice value).
RAWRS The number of raw datagrams received and sent by this process.
This information can only be shown when kernel patch ‘cnt’ is
installed.
If a process has finished during the last interval, no value
is shown since network counters are not registered in the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
RDDSK When the kernel patch ‘cnt’ is installed: The number of read
accesses issued physically on disk (so reading from the disk
cache is not accounted for).
When the kernel patch ‘cnt’ is not installed, but the kernel
maintains standard io statistics (>= 2.6.20): The read data
transfer issued physically on disk (so reading from the disk
cache is not accounted for).
RGROW The amount of resident memory that the process has grown
during the last interval. A resident growth can be caused by
touching memory pages which were not physically created/loaded
before (load-on-demand). Note that a resident growth can also
be negative e.g. when part of the process is paged out due to
lack of memory or when the process frees dynamically allocated
memory. For a process which started during the last interval,
the resident growth reflects the total resident size of the
process at that moment.
If a process has finished during the last interval, no value
is shown since resident memory occupation is not part of the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
RNET The number of TCP- and UDP packets received by this process.
This information can only be shown when kernel patch ‘cnt’ is
installed.
If a process has finished during the last interval, no value
is shown since network counters are not part of the standard
process accounting record. However when the kernel patch
‘acct’ is installed, this value will be shown.
RSIZE The total resident memory usage consumed by this process (or
user).
If a process has finished during the last interval, no value
is shown since resident memory occupation is not part of the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
RTPR Realtime priority according the POSIX standard. Value can be
0 for a timesharing process (policy ’norm’) or ranges from 1
(lowest) till 99 (highest) for a realtime process (policy ’rr’
or ’fifo’).
S The current state of the process: ‘R’ for running (currently
processing or in the run queue), ‘S’ for sleeping
interruptable (wait for an event to occur), ‘D’ for sleeping
non-interruptable, ‘Z’ for zombie (waiting to be synchronized
with its parent process), ‘T’ for stopped (suspended or
traced), ‘W’ for swapping, and ‘E’ (exit) for processes which
have finished during the last interval.
SNET The number of TCP- and UDP packets transmitted by this
process. This information can only be shown when kernel patch
‘cnt’ is installed.
If a process has finished during the last interval, no value
is shown since network-counters are not part of the standard
process accounting record. However when the kernel patch
‘acct’ is installed, this value will be shown.
ST The status of a process.
The first position indicates if the process has been started
during the last interval (the value N means ’new process’).
The second position indicates if the process has been finished
during the last interval.
The value E means ’exit’ on the process’ own initiative; the
exit code is displayed in the column ‘EXC’.
The value S means that the process has been terminated
unvoluntarily by a signal; the signal number is displayed in
the in the column ‘EXC’.
The value C means that the process has been terminated
unvoluntarily by a signal, producing a core dump in its
current directory; the signal number is displayed in the
column ‘EXC’.
STDATE The start date of the process.
STTIME The start time of the process.
SYSCPU CPU time consumption of this process in system mode (kernel
mode), usually due to system call handling.
TCPRCV The number of receive requests issued by this process for TCP
sockets, and the average size per transfer in bytes. This
information can only be shown when kernel patch ‘cnt’ is
installed.
If a process has finished during the last interval, no value
is shown since network counters are not registered in the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
TCPSND The number of send requests issued by this process for TCP
sockets, and the average size per transfer in bytes. This
information can only be shown when kernel patch ‘cnt’ is
installed.
If a process has finished during the last interval, no value
is shown since network counters are not registered in the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
THR Total number of threads within this process. All related
threads are contained in a thread group, represented by atop
as one line.
On Linux 2.4 systems it is hardly possible to determine which
threads (i.e. processes) are related to the same thread group.
Every thread is represented by atop as a separate line.
TRUN Number of threads within this process that are in the state
’running’ (R).
TSLPI Number of threads within this process that are in the state
’interruptible sleeping’ (S).
TSLPU Number of threads within this process that are in the state
’uninterruptible sleeping’ (D).
UDPRCV The number of UDP datagrams received by this process, and the
average size per transfer in bytes. This information can only
be shown when kernel patch ‘cnt’ is installed.
If a process has finished during the last interval, no value
is shown since network counters are not registered in the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
UDPSND The number of UDP datagrams transmitted by this process, and
the average size per transfer in bytes. This information can
only be shown when kernel patch ‘cnt’ is installed.
If a process has finished during the last interval, no value
is shown since network counters are not registered in the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
USERNAME The real user identity under which the process runs.
USRCPU CPU time consumption of this process in user mode, due to
processing the own program text.
VGROW The amount of virtual memory that the process has grown during
the last interval. A virtual growth can be caused by e.g.
issueing a malloc() or attaching a shared memory segment. Note
that a virtual growth can also be negative by e.g. issueing a
free() or detaching a shared memory segment. For a process
which started during the last interval, the virtual growth
reflects the total virtual size of the process at that moment.
If a process has finished during the last interval, no value
is shown since virtual memory occupation is not part of the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
VSIZE The total virtual memory usage consumed by this process (or
user).
If a process has finished during the last interval, no value
is shown since virtual memory occupation is not part of the
standard process accounting record. However when the kernel
patch ‘acct’ is installed, this value will be shown.
VSTEXT The virtual memory size used by the shared text of this
process.
WRDSK When the kernel patch ‘cnt’ is installed: The number of write
accesses issued physically on disk (so writing to the disk
cache is not accounted for). Usually application processes
just transfer their data to the cache, while the physical
write accesses are done later on by kernel daemons like
pdflush. Note that the number read- and write accesses are
not separately maintained in the standard process accounting
record. This means that only one value is given for read’s
and write’s in case a process has finished during the last
interval. However when the kernel patch ‘acct’ is installed,
these values will be shown separately.
When the kernel patch ‘cnt’ is not installed, but the kernel
maintains standard io statistics (>= 2.6.20): The write data
transfer issued physically on disk (so writing to the disk
cache is not accounted for). This counter is maintained for
the application process that writes its data to the cache
(assuming that this data is physically transferred to disk
later on). Notice that disk I/O needed for swapping is not
taken into account.
WRDSK_CANCEL
When the kernel patch ‘cnt’ is not installed, but the kernel
maintains standard io statistics (>= 2.6.20): The write data
transfer previously accounted for this process or another
process that has been cancelled. E.g. when a process writes
new data to a file and that data is removed again before the
cache buffers have been flushed to disk. The original process
shows the written data as WRDSK, while the process that
removes/truncates the file shows the unflushed removed data as
WRDSK_CANCEL.
PARSEABLE OUTPUT
With the flag -P followed by a list of one or more labels (comma-
separated), parseable output is produced for each sample. The labels
that can be specified for system-level statistics correspond to the
labels (first verb of each line) that can be found in the interactive
output: "CPU", "cpu" "CPL" "MEM", "SWP", "PAG", "DSK" and "NET".
For process-level statistics special labels are introduced: "PRG"
(general), "PRC" (cpu), "PRM" (memory), "PRD" (disk, only if the
kernel-patch has been installed) and "PRN" (network, only if the
kernel-patch has been installed).
With the label "ALL", all system- and process-level statistics are
shown.
For every interval all requested lines are shown whereafter atop shows
a line just containing the label "SEP" as a separator before the lines
for the next sample are generated.
The first part of each output-line consists of the following six
fields: label (the name of the label), host (the name of this machine),
epoch (the time of this interval as number of seconds since 1-1-1970),
date (date of this interval in format YYYY/MM/DD), time (time of this
interval in format HH:MM:SS), and interval (number of seconds elapsed
for this interval).
The subsequent fields of each output-line depend on the label:
CPU Subsequent fields: total number of clock-ticks per second for
this machine, number of processors, consumption for all CPU’s
in system mode (clock-ticks), consumption for all CPU’s in
user mode (clock-ticks), consumption for all CPU’s in user
mode for niced processes (clock-ticks), consumption for all
CPU’s in idle mode (clock-ticks), consumption for all CPU’s in
wait mode (clock-ticks), consumption for all CPU’s in irq mode
(clock-ticks), consumption for all CPU’s in softirq mode
(clock-ticks), and consumption for all CPU’s in steal mode
(clock-ticks).
cpu Subsequent fields: total number of clock-ticks per second for
this machine, processor-number, consumption for this CPU in
system mode (clock-ticks), consumption for this CPU in user
mode (clock-ticks), consumption for this CPU in user mode for
niced processes (clock-ticks), consumption for this CPU in
idle mode (clock-ticks), consumption for this CPU in wait mode
(clock-ticks), consumption for this CPU in irq mode (clock-
ticks), consumption for this CPU in softirq mode (clock-
ticks), and consumption for this CPU in steal mode (clock-
ticks).
CPL Subsequent fields: number of processors, load average for last
minute, load average for last five minutes, load average for
last fifteen minutes, number of context-switches, and number
of device interrupts.
MEM Subsequent fields: page size for this machine (in bytes), size
of physical memory (pages), size of free memory (pages), size
of page cache (pages), size of buffer cache (pages), and size
of slab (pages).
SWP Subsequent fields: page size for this machine (in bytes), size
of swap (pages), size of free swap (pages), 0 (future use),
size of committed space (pages), and limit for committed space
(pages).
PAG Subsequent fields: page size for this machine (in bytes),
number of page scans, number of allocstalls, 0 (future use),
number of swapins, and number of swapouts.
DSK For every disk one line is shown.
Subsequent fields: name of disk, number of milliseconds spent
for I/O, number of reads issued, number of sectors transferred
for reads, number of writes issued, and number of sectors
transferred for write.
NET First one line is produced for the upper layers of the TCP/IP
stack.
Subsequent fields: the verb "upper", number of packets
received by TCP, number of packets transmitted by TCP, number
of packets received by UDP, number of packets transmitted by
UDP, number of packets received by IP, number of packets
transmitted by IP, number of packets delivered to higher
layers by IP, and number of packets forwarded by IP.
Next one line is shown for every interface.
Subsequent fields: name of the interface, number of packets
received by the interface, number of bytes received by the
interface, number of packets transmitted by the interface,
number of bytes transmitted by the interface, interface speed,
and duplex mode (0=half, 1=full).
PRG For every process one line is shown.
Subsequent fields: PID, name (between brackets), state, real
uid, real gid, TGID (same as PID), total number of threads,
exit code, start time (epoch), full command line (between
brackets), PPID, number of threads in state ’running’ (R),
number of threads in state ’interruptible sleeping’ (S), and
number of threads in state ’uninterruptible sleeping’ (D).
PRC For every process one line is shown.
Subsequent fields: PID, name (between brackets), state, total
number of clock-ticks per second for this machine, CPU-
consumption in user mode (clockticks), CPU-consumption in
system mode (clockticks), nice value, priority, realtime
priority, scheduling policy, current CPU, and sleep average.
PRM For every process one line is shown.
Subsequent fields: PID, name (between brackets), state, page
size for this machine (in bytes), virtual memory size
(Kbytes), resident memory size (Kbytes), shared text memory
size (Kbytes), virtual memory growth (Kbytes), resident memory
growth (Kbytes), number of minor page faults, and number of
major page faults.
PRD For every process one line is shown.
Subsequent fields: PID, name (between brackets), state,
kernel-patch installed (’y’ or ’n’), standard io statistics
used (’y’ or ’n’), number of reads on disk, cumulative number
of sectors read, number of writes on disk, cumulative number
of sectors written, and cancelled number of written sectors.
If the kernel patch is not installed and the standard I/O
statistics (>= 2.6.20) are not used, the disk I/O counters per
process are not relevant. When the kernel patch is installed,
the counter ’cancelled number of written sectors’ is not
relevant. When only the standard io statistics are used, the
counters ’number of reads on disk’ and ’number of writes on
disk’ are not relevant.
PRN For every process one line is shown.
Subsequent fields: PID, name (between brackets), state,
kernel-patch installed (’y’ or ’n’), number of TCP-packets
transmitted, cumulative size of TCP-packets transmitted,
number of TCP-packets received, cumulative size of TCP-packets
received, number of UDP-packets transmitted, cumulative size
of UDP-packets transmitted, number of UDP-packets received,
cumulative size of UDP-packets transmitted, number of raw
packets transmitted, and number of raw packets received.
If the kernel patch is not installed, the network I/O counters
per process are not relevant.
EXAMPLES
To monitor the current system load interactively with an interval of 5
seconds:
atop 5
To monitor the system load and write it to a file (in plain ASCII) with
an interval of one minute during half an hour with active processes
sorted on memory consumption:
atop -M 60 30 > /log/atop.mem
Store information about the system- and process activity in binary
compressed form to a file with an interval of ten minutes during an
hour:
atop -w /tmp/atop.raw 600 6
View the contents of this file interactively:
atop -r /tmp/atop.raw
View the processor- and disk-utilization of this file in parseable
format:
atop -PCPU,DSK -r /tmp/atop.raw
CONFIGURATION FILE
The default values used by atop can be overruled by a personal
configuration file. This file, called ~/.atoprc contains a keyword-
value pair on every line (blank lines and lines starting with a #-sign
are skipped). The following keywords can be specified:
flags A list of default flags for atop can be defined here. The
flags which are allowed are ’g’, ’m’, ’d’, ’n’, ’u’, ’p’, ’s’,
’c’, ’v’, ’C’, ’M’, ’D’, ’N’, ’A’, ’a’, ’f’, ’1’ and ’x’.
interval The default interval value in seconds.
username The default regular expression for the users for which active
processes will be shown.
procname The default regular expression for the process names to be
shown.
maxlinecpu
The maximum number of active CPU’s which will be shown.
maxlinedisk
The maximum number of active disks which will be shown.
maxlineintf
The maximum number of active network interfaces which will be
shown.
cpucritperc
The busy percentage considered critical for a processor (see
section COLORS). This percentage is used to determine a
weighted percentage for line coloring and sorting of active
processes. When this value is zero, no line coloring or
automatic sorting is performed for this resource.
dskcritperc
The busy percentage considered critical for a disk (see
section COLORS). This percentage is used to determine a
weighted percentage for line coloring and sorting of active
processes. When this value is zero, no line coloring or
automatic sorting is performed for this resource.
netcritperc
The busy percentage considered critical for a network
interface (see section COLORS). This percentage is used to
determine a weighted percentage for line coloring and sorting
of active processes. When this value is zero, no line
coloring or automatic sorting is performed for this resource.
memcritperc
The percentage considered critical for memory utilization (see
section COLORS). This percentage is used to determine a
weighted percentage for line coloring and sorting of active
processes. When this value is zero, no line coloring or
automatic sorting is performed for this resource.
swpcritperc
The occupation percentage considered critical for swap space
(see section COLORS). This percentage is used to determine a
weighted percentage for line coloring and sorting of active
processes. When this value is zero, no line coloring or
automatic sorting is performed for this resource.
swoutcritsec
The number of pages swapped out per second considered critical
for for memory utilization (see section COLORS). This
threshold is used in combination with ’memcritperc’ to
determine a weighted percentage for line coloring and sorting
of active processes. When this value is zero, no line
coloring or automatic sorting is performed for this resource.
almostcrit
A percentage of the critical percentage to determine if the
resource is almost critical (see section COLORS). When this
value is zero, no line coloring for ‘almost critical’ is
performed.
atopsarflags
A list of default flags for atopsar can be defined here (see
description in related man-page).
An example of the ~/.atoprc file:
flags Aaf
interval 5
username
procname
maxlinecpu 4
maxlinedisk 10
maxlineintf 5
cpucritperc 80
almostcrit 90
atopsarflags CMH
FILES
/tmp/atop.d/atop.acct
File in which the kernel writes the accounting records if the
standard accounting to the file /var/log/pacct or
/var/account/pacct is not used.
~/.atoprc
Configuration file containing personal default values.
/var/log/atop.log[.X]
Raw file, where X is the age in days as added by logrotate(1).
This name is used by atop as default name for the input file when
using the -r flag.
All binary system- and process-level data in this file has been
stored in compressed format.
SEE ALSO
atopsar(1), logrotate(8)
http://www.ATComputing.nl/Tools/atop
AUTHOR
Gerlof Langeveld, AT Computing (gerlof@ATComputing.nl), Debian package
by Edelhard Becker.