man
1 ATOP
ATOP(1) General Commands Manual ATOP(1)
NAME
atop - Advanced System & Process Monitor
SYNOPSIS
Interactive Usage:
atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-afFG1xR]
[-L linelen] [-Plabel[,label]... [-Z]] [ interval [ samples ]]
Writing and reading raw logfiles:
atop -w rawfile [-a] [-S] [ interval [ samples ]]
atop -r [ rawfile ] [-b [YYYYMMDD]hhmm ] [-e [YYYYMMDD]hhmm ]
[-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-fFG1xR] [-L
linelen] [-Plabel[,label]... [-Z]]
DESCRIPTION
The program atop is an interactive monitor to view the load on a Linux
system. It shows the occupation of the most critical hardware re-
sources (from a performance point of view) on system level, i.e. cpu,
memory, disk and network.
It also shows which processes are responsible for the indicated load
with respect to cpu and memory load on process level. Disk load is
shown per process if "storage accounting" is active in the kernel.
Network load is shown per process if the kernel module `netatop' has
been installed.
The initial screen shows if atop runs with restricted view (unprivi-
leged) or unrestricted view (privileged). In case of restricted view
atop does not have the privileges (root identity or necessary capabili-
ties) to retrieve all counter values on system level and on process
level.
Every interval (default: 10 seconds) information is shown about the re-
source occupation on system level (cpu, memory, disks and network lay-
ers), followed by a list of processes which have been active during the
last interval (note that all processes that were unchanged during the
last interval are not shown, unless the key 'a' has been pressed or un-
less sorting on memory occupation is done). If the list of active pro-
cesses does not entirely fit on the screen, only the top of the list is
shown (sorted in order of activity).
The intervals are repeated till the number of samples (specified as
command argument) is reached, or till the key 'q' is pressed in inter-
active mode.
When atop is started, it checks whether the standard output channel is
connected to a screen, or to a file/pipe. In the first case it produces
screen control codes (via the ncurses library) and behaves interac-
tively; in the second case it produces flat ASCII-output.
In interactive mode, the output of atop scales dynamically to the cur-
rent dimensions of the screen/window.
If the window is resized horizontally, columns will be added or removed
automatically. For this purpose, every column has a particular weight.
The columns with the highest weights that fit within the current width
will be shown.
If the window is resized vertically, lines of the process/thread list
will be added or removed automatically.
Furthermore in interactive mode the output of atop can be controlled by
pressing particular keys. However it is also possible to specify such
key as flag on the command line. In that case atop switches to the in-
dicated mode on beforehand; this mode can be modified again interac-
tively. Specifying such key as flag is especially useful when running
atop with output to a pipe or file (non-interactively). These flags
are the same as the keys that can be pressed in interactive mode (see
section INTERACTIVE COMMANDS).
Additional flags are available to support storage of atop-data in raw
format (see section RAW DATA STORAGE).
PROCESS ACCOUNTING
With every interval, atop reads the kernel administration to obtain in-
formation about all running processes. However, it is likely that dur-
ing the interval also processes have terminated. These processes might
have consumed system resources during this interval as well before they
terminated. Therefor, atop tries to read the process accounting
records that contain the accounting information of terminated processes
and report these processes too. Only when the process accounting mech-
anism in the kernel is activated, the kernel writes such process ac-
counting record to a file for every process that terminates.
There are various ways for atop to get access to the process accounting
records (tried in this order):
1. When the environment variable ATOPACCT is set, it specifies the
name of the process accounting file. In that case, process ac-
counting for this file should have been activated on beforehand.
Before opening this file for reading, atop drops its root privi-
leges (if any).
When this environment variable is present but its contents is
empty, process accounting will not be used at all.
2. This is the preferred way of handling process accounting records!
When the atopacctd daemon is active, it has activated the process
accounting mechanism in the kernel and transfers to original ac-
counting records to shadow files. In that case, atop drops its
root privileges and opens the current shadow file for reading.
This way is preferred, because the atopacctd daemon maintains full
control of the size of the original process accounting file written
by the kernel and the shadow files read by the atop process(es).
The atopacct service will be activated before the atop service to
enable atop to detect that process accounting is managed by the
atopacctd daemon. As a forking service, atopacctd takes care that
all directories and files are initialized before the parent process
dies. The child process continues as the daemon process.
For further information, refer to the atopacctd man page.
3. When the atopacctd daemon is not active, atop verifies if the
process accounting mechanism has been switched on via the separate
psacct or acct package (the package name depends on the Linux dis-
tro). In that case, one of the files /var/log/pacct, /var/ac-
count/pacct or /var/log/account/pacct is in use as process account-
ing file and atop opens this file for reading.
4. As a last possibility, atop itself tries to activate the process
accounting mechanism (requires root privileges) using the file
/var/cache/atop.d/atop.acct (to be written by the kernel, to be
read by atop itself). Process accounting remains active as long as
at least one atop process is alive. Whenever the last atop process
stops (either by pressing `q' or by `kill -15'), it deactivates the
process accounting mechanism again. Therefor you should never ter-
minate atop by `kill -9', because then it has no chance to stop
process accounting. As a result, the accounting file may consume a
lot of disk space after a while.
To avoid that the process accounting file consumes too much disk
space, atop verifies at the end of every sample if the size of the
process accounting file exceeds 200 MiB and if this atop process is
the only one that is currently using the file. In that case the
file is truncated to a size of zero.
Notice that root-privileges are required to switch on/off process
accounting in the kernel. You can start atop as a root user or
specify setuid-root privileges to the executable file. In the lat-
ter case, atop switches on process accounting and drops the root-
privileges again.
If atop does not run with root-privileges, it does not show infor-
mation about finished processes. It indicates this situation with
the message message `no procacct` in the top-right corner (instead
of the counter that shows the number of exited processes).
When during one interval a lot of processes have finished, atop might
grow tremendously in memory when reading all process accounting records
at the end of the interval. To avoid such excessive growth, atop will
never read more than 50 MiB with process information from the process
accounting file per interval (approx. 70000 finished processes). In
interactive mode a warning is given whenever processes have been
skipped for this reason.
COLORS
For the resource consumption on system level, atop uses colors to indi-
cate that a critical occupation percentage has been (almost) reached.
A critical occupation percentage means that is likely that this load
causes a noticeable negative performance influence for applications us-
ing this resource. The critical percentage depends on the type of re-
source: e.g. the performance influence of a disk with a busy percentage
of 80% might be more noticeable for applications/user than a CPU with a
busy percentage of 90%.
Currently atop uses the following default values to calculate a
weighted percentage per resource:
Processor
A busy percentage of 90% or higher is considered `critical'.
Disk
A busy percentage of 70% or higher is considered `critical'.
Network
A busy percentage of 90% or higher for the load of an interface is
considered `critical'.
Memory
An occupation percentage of 90% is considered `critical'. Notice
that this occupation percentage is the accumulated memory consump-
tion of the kernel (including slab) and all processes; the memory
for the page cache (`cache' and `buff' in the MEM-line) and the
reclaimable part of the slab (`slrec`) is not implied!
If the number of pages swapped out (`swout' in the PAG-line) is
larger than 10 per second, the memory resource is considered
`critical'. A value of at least 1 per second is considered `al-
most critical'.
If the committed virtual memory exceeds the limit (`vmcom' and
`vmlim' in the SWP-line), the SWP-line is colored due to overcom-
mitting the system.
Swap
An occupation percentage of 80% is considered `critical' because
swap space might be completely exhausted in the near future; it is
not critical from a performance point-of-view.
These default values can be modified in the configuration file (see
separate man-page of atoprc).
When a resource exceeds its critical occupation percentage, the con-
cerning values in the screen line are colored red by default.
When a resource exceeded (default) 80% of its critical percentage (so
it is almost critical), the concerning values in the screen line are
colored cyan by default. This `almost critical percentage' (one value
for all resources) can be modified in the configuration file (see sepa-
rate man-page of atoprc).
The default colors red and cyan can be modified in the configuration
file as well (see separate man-page of atoprc).
With the key 'x' (or flag -x), the use of colors can be suppressed.
NETATOP MODULE
Per-process and per-thread network activity can be measured by the ne-
tatop kernel module. You can download this kernel module from the web-
site (mentioned at the end of this manual page) and install it on your
system if the kernel version is 2.6.24 or newer.
When atop gathers counters for a new interval, it verifies if the ne-
tatop module is currently active. If so, atop obtains the relevant net-
work counters from this module and shows the number of sent and re-
ceived packets per process/thread in the generic screen. Besides, de-
tailed counters can be requested by pressing the `n' key.
When the netatopd daemon is running as well, atop also reads the net-
work counters of exited processes that are logged by this daemon (com-
parable with process accounting).
More information about the optional netatop kernel module and the ne-
tatopd daemon can be found in the concerning man-pages and on the web-
site mentioned at the end of this manual page.
GPU STATISTICS GATHERING
GPU statistics can be gathered by atopgpud which is a separate data
collection daemon process. It gathers cumulative utilization counters
of every Nvidia GPU in the system, as well as utilization counters of
every process that uses a GPU. When atop notices that the daemon is
active, it reads these GPU utilization counters with every interval.
The atopgpud daemon is written in Python, so a Python interpreter
should be installed on the target system. The Python code of the daemon
is compatible with Python version 2 and version 3. For the gathering
of the statistics, the pynvml module is used by the daemon. Be sure
that this module is installed on the target system before activating
the daemon, by running the command as root pip (the command pip might
be exchanged by pip3 in case of Python3):
pip install nvidia-ml-py
The atopgpud daemon is installed by default as part of the atop pack-
age, but it is not automatically enabled. The daemon can be enabled
and started now by running the following commands (as root):
systemctl enable atopgpu
systemctl start atopgpu
Find a description about the utilization counters in the section OUTPUT
DESCRIPTION.
INTERACTIVE COMMANDS
When running atop interactively (no output redirection), keys can be
pressed to control the output. In general, lower case keys can be used
to show other information for the active processes and upper case keys
can be used to influence the sort order of the active process/thread
list.
g Show generic output (default).
Per process the following fields are shown in case of a window-
width of 80 positions: process-id, cpu consumption during the last
interval in system and user mode, the virtual and resident memory
growth of the process.
The subsequent columns depend on the used kernel:
When the kernel supports "storage accounting" (>= 2.6.20), the
data transfer for read/write on disk, the status and exit code are
shown for each process. When the kernel does not support "storage
accounting", the username, number of threads in the thread group,
the status and exit code are shown.
When the kernel module 'netatop' is loaded, the data transfer for
send/receive of network packets is shown for each process.
The last columns contain the state, the occupation percentage for
the chosen resource (default: cpu) and the process name.
When more than 80 positions are available, other information is
added.
m Show memory related output.
Per process the following fields are shown in case of a window-
width of 80 positions: process-id, minor and major memory faults,
size of virtual shared text, total virtual process size, total
resident process size, virtual and resident growth during last in-
terval, memory occupation percentage and process name.
When more than 80 positions are available, other information is
added.
For memory consumption, always all processes are shown (also the
processes that were not active during the interval).
d Show disk-related output.
When "storage accounting" is active in the kernel, the following
fields are shown: process-id, amount of data read from disk,
amount of data written to disk, amount of data that was written
but has been withdrawn again (WCANCL), disk occupation percentage
and process name.
n Show network related output.
Per process the following fields are shown in case of a window-
width of 80 positions: process-id, thread-id, total bandwidth for
received packets, total bandwidth for sent packets, number of re-
ceived TCP packets with the average size per packet (in bytes),
number of sent TCP packets with the average size per packet (in
bytes), number of received UDP packets with the average size per
packet (in bytes), number of sent UDP packets with the average
size per packet (in bytes), the network occupation percentage and
process name.
This information can only be shown when kernel module `netatop' is
installed.
When more than 80 positions are available, other information is
added.
s Show scheduling characteristics.
Per process the following fields are shown in case of a window-
width of 80 positions: process-id, number of threads in state
'running' (R), number of threads in state 'interruptible sleeping'
(S), number of threads in state 'uninterruptible sleeping' (D),
scheduling policy (normal timesharing, realtime round-robin, real-
time fifo), nice value, priority, realtime priority, current pro-
cessor, status, exit code, state, the occupation percentage for
the chosen resource and the process name.
When more than 80 positions are available, other information is
added.
v Show various process characteristics.
Per process the following fields are shown in case of a window-
width of 80 positions: process-id, user name and group, start date
and time, status (e.g. exit code if the process has finished),
state, the occupation percentage for the chosen resource and the
process name.
When more than 80 positions are available, other information is
added.
c Show the command line of the process.
Per process the following fields are shown: process-id, the occu-
pation percentage for the chosen resource and the command line in-
cluding arguments.
e Show GPU utilization.
Per process at least the following fields are shown: process-id,
range of GPU numbers on which the process currently runs, GPU busy
percentage on all GPUs, memory busy percentage (i.e. read and
write accesses on memory) on all GPUs, memory occupation at the
moment of the sample, average memory occupation during the sample,
and GPU percentage.
When the atopgpud daemon does not run with root privileges, the
GPU busy percentage and the memory busy percentage are not avail-
able on process level. In that case, the GPU percentage on
process level reflects the GPU memory occupation instead of the
GPU busy percentage (which is preferred).
o Show the user-defined line of the process.
In the configuration file the keyword ownprocline can be specified
with the description of a user-defined output-line.
Refer to the man-page of atoprc for a detailed description.
y Show the individual threads within a process (toggle).
Single-threaded processes are still shown as one line.
For multi-threaded processes, one line represents the process
while additional lines show the activity per individual thread (in
a different color). Depending on the option 'a' (all or active
toggle), all threads are shown or only the threads that were ac-
tive during the last interval. Depending on the option 'Y' (sort
threads), the threads per process will be sorted on the chosen
sort criterium or not.
Whether this key is active or not can be seen in the header line.
Y Sort the threads per process when combined with option 'y' (tog-
gle).
u Show the process activity accumulated per user.
Per user the following fields are shown: number of processes ac-
tive or terminated during last interval (or in total if combined
with command `a'), accumulated cpu consumption during last inter-
val in system and user mode, the current virtual and resident mem-
ory space consumed by active processes (or all processes of the
user if combined with command `a').
When "storage accounting" is active in the kernel, the accumulated
read and write throughput on disk is shown. When the kernel mod-
ule `netatop' has been installed, the number of received and sent
network packets are shown.
The last columns contain the accumulated occupation percentage for
the chosen resource (default: cpu) and the user name.
p Show the process activity accumulated per program (i.e. process
name).
Per program the following fields are shown: number of processes
active or terminated during last interval (or in total if combined
with command `a'), accumulated cpu consumption during last inter-
val in system and user mode, the current virtual and resident mem-
ory space consumed by active processes (or all processes of the
user if combined with command `a').
When "storage accounting" is active in the kernel, the accumulated
read and write throughput on disk is shown. When the kernel mod-
ule `netatop' has been installed, the number of received and sent
network packets are shown.
The last columns contain the accumulated occupation percentage for
the chosen resource (default: cpu) and the program name.
j Show the process activity accumulated per Docker container.
Per container the following fields are shown: number of processes
active or terminated during last interval (or in total if combined
with command `a'), accumulated cpu consumption during last inter-
val in system and user mode, the current virtual and resident mem-
ory space consumed by active processes (or all processes of the
user if combined with command `a').
When "storage accounting" is active in the kernel, the accumulated
read and write throughput on disk is shown. When the kernel mod-
ule `netatop' has been installed, the number of received and sent
network packets are shown.
The last columns contain the accumulated occupation percentage for
the chosen resource (default: cpu) and the Docker container id
(CID).
C Sort the current list in the order of cpu consumption (default).
The one-but-last column changes to ``CPU''.
E Sort the current list in the order of GPU utilization (preferred,
but only applicable when the atopgpud daemon runs under root priv-
ileges) or the order of GPU memory occupation). The one-but-last
column changes to ``GPU''.
M Sort the current list in the order of resident memory consumption.
The one-but-last column changes to ``MEM''. In case of sorting on
memory, the full process list will be shown (not only the active
processes).
D Sort the current list in the order of disk accesses issued. The
one-but-last column changes to ``DSK''.
N Sort the current list in the order of network bandwidth (received
and transmitted). The one-but-last column changes to ``NET''.
A Sort the current list automatically in the order of the most busy
system resource during this interval. The one-but-last column
shows either ``ACPU'', ``AMEM'', ``ADSK'' or ``ANET'' (the preced-
ing 'A' indicates automatic sorting-order). The most busy re-
source is determined by comparing the weighted busy-percentages of
the system resources, as described earlier in the section COLORS.
This option remains valid until another sorting-order is explic-
itly selected again.
A sorting-order for disk is only possible when "storage account-
ing" is active. A sorting-order for network is only possible when
the kernel module `netatop' is loaded.
Miscellaneous interactive commands:
? Request for help information (also the key 'h' can be pressed).
V Request for version information (version number and date).
R Gather and calculate the proportional set size of processes (tog-
gle). Gathering of all values that are needed to calculate the
PSIZE of a process is a very time-consuming task, so this key
should only be active when analyzing the resident memory consump-
tion of processes.
W Get the WCHAN per thread (toggle). Gathering of the WCHAN string
per thread is a relatively time-consuming task, so this key should
only be made active when analyzing the reason for threads to be in
sleep state.
x Suppress colors to highlight critical resources (toggle).
Whether this key is active or not can be seen in the header line.
z The pause key can be used to freeze the current situation in order
to investigate the output on the screen. While atop is paused, the
keys described above can be pressed to show other information
about the current list of processes. Whenever the pause key is
pressed again, atop will continue with a next sample.
i Modify the interval timer (default: 10 seconds). If an interval
timer of 0 is entered, the interval timer is switched off. In that
case a new sample can only be triggered manually by pressing the
key 't'.
t Trigger a new sample manually. This key can be pressed if the cur-
rent sample should be finished before the timer has exceeded, or
if no timer is set at all (interval timer defined as 0). In the
latter case atop can be used as a stopwatch to measure the load
being caused by a particular application transaction, without
knowing on beforehand how many seconds this transaction will last.
When viewing the contents of a raw file this key can be used to
show the next sample from the file. This key can also be used when
viewing raw data via a pipe.
T When viewing the contents of a raw file this key can be used to
show the previous sample from the file, however not when reading
raw data from a pipe.
b When viewing the contents of a raw file, this key can be used to
branch to a certain timestamp within the file either forward or
backward. When viewing raw data from a pipe only forward branches
are possible.
r Reset all counters to zero to see the system and process activity
since boot again.
When viewing the contents of a raw file, this key can be used to
rewind to the beginning of the file again (except when reading raw
data from a pipe).
U Specify a search string for specific user names as a regular ex-
pression. From now on, only (active) processes will be shown from
a user which matches the regular expression. The system statis-
tics are still system wide. If the Enter-key is pressed without
specifying a name, (active) processes of all users will be shown
again.
Whether this key is active or not can be seen in the header line.
I Specify a list with one or more PIDs to be selected. From now on,
only processes will be shown with a PID which matches one of the
given list. The system statistics are still system wide. If the
Enter-key is pressed without specifying a PID, all (active) pro-
cesses will be shown again.
Whether this key is active or not can be seen in the header line.
P Specify a search string for specific process names as a regular
expression. From now on, only processes will be shown with a name
which matches the regular expression. The system statistics are
still system wide. If the Enter-key is pressed without specifying
a name, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
/ Specify a specific command line search string as a regular expres-
sion. From now on, only processes will be shown with a command
line which matches the regular expression. The system statistics
are still system wide. If the Enter-key is pressed without speci-
fying a string, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
J Specify a Docker container id of 12 (hexadecimal) characters.
From now on, only processes will be shown that run in that spe-
cific Docker container (CID). The system statistics are still
system wide. If the Enter-key is pressed without specifying a
container id, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
Q Specify a comma-separated list of process/thread state characters.
From now on, only processes/threads will be shown that are in
those specific states. Accepted states are: R (running), S
(sleeping), D (disk sleep), I (idle), T (stopped), t (tracing
stop), X (dead), Z (zombie) and P (parked). The system statistics
are still system wide. If the Enter-key is pressed without speci-
fying a state, all (active) processes/threads will be shown again.
Whether this key is active or not can be seen in the header line.
S Specify search strings for specific logical volume names, specific
disk names and specific network interface names. All search
strings are interpreted as a regular expressions. From now on,
only those system resources are shown that match the concerning
regular expression. If the Enter-key is pressed without specify-
ing a search string, all (active) system resources of that type
will be shown again.
Whether this key is active or not can be seen in the header line.
a The `all/active' key can be used to toggle between only show-
ing/accumulating the processes that were active during the last
interval (default) or showing/accumulating all processes.
Whether this key is active or not can be seen in the header line.
G By default, atop shows/accumulates the processes that are alive
and the processes that are exited during the last interval. With
this key (toggle), showing/accumulating the processes that are ex-
ited can be suppressed.
Whether this key is active or not can be seen in the header line.
f Show a fixed (maximum) number of header lines for system resources
(toggle). By default only the lines are shown about system re-
sources (CPUs, paging, logical volumes, disks, network interfaces)
that really have been active during the last interval. With this
key you can force atop to show lines of inactive resources as
well.
Whether this key is active or not can be seen in the header line.
F Suppress sorting of system resources (toggle). By default system
resources (CPUs, logical volumes, disks, network interfaces) are
sorted on utilization.
Whether this key is active or not can be seen in the header line.
1 Show relevant counters as an average per second (in the format
`..../s') instead of as a total during the interval (toggle).
Whether this key is active or not can be seen in the header line.
l Limit the number of system level lines for the counters per-cpu,
the active disks and the network interfaces. By default lines are
shown of all CPUs, disks and network interfaces which have been
active during the last interval. Limiting these lines can be use-
ful on systems with huge number CPUs, disks or interfaces in order
to be able to run atop on a screen/window with e.g. only 24 lines.
For all mentioned resources the maximum number of lines can be
specified interactively. When using the flag -l the maximum number
of per-cpu lines is set to 0, the maximum number of disk lines to
5 and the maximum number of interface lines to 3. These values
can be modified again in interactive mode.
k Send a signal to an active process (a.k.a. kill a process).
q Quit the program.
PgDn Show the next page of the process/thread list.
With the arrow-down key the list can be scrolled downwards with
single lines.
^F Show the next page of the process/thread list (forward).
With the arrow-down key the list can be scrolled downwards with
single lines.
PgUp Show the previous page of the process/thread list.
With the arrow-up key the list can be scrolled upwards with single
lines.
^B Show the previous page of the process/thread list (backward).
With the arrow-up key the list can be scrolled upwards with single
lines.
^L Redraw the screen.
RAW DATA STORAGE
In order to store system and process level statistics for long-term
analysis (e.g. to check the system load and the active processes run-
ning yesterday between 3:00 and 4:00 PM), atop can store the system and
process level statistics in compressed binary format in a raw file with
the flag -w followed by the filename. If this file already exists and
is recognized as a raw data file, atop will append new samples to the
file (starting with a sample which reflects the activity since boot);
if the file does not exist, it will be created.
All information about processes and threads is stored in the raw file.
The interval (default: 10 seconds) and number of samples (default: in-
finite) can be passed as last arguments. Instead of the number of sam-
ples, the flag -S can be used to indicate that atop should finish any-
how before midnight.
A raw file can be read and visualized again with the flag -r followed
by the filename. If no filename is specified, the file
/var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are
digits representing the current date). If a filename is specified in
the format YYYYMMDD (representing any valid date), the file
/var/log/atop/atop_YYYYMMDD is opened. If a filename with the symbolic
name y is specified, yesterday's daily logfile is opened (this can be
repeated so 'yyyy' indicates the logfile of four days ago). If the
filename - is used, stdin will be read.
The samples from the file can be viewed interactively by using the key
't' to show the next sample, the key 'T' to show the previous sample,
the key 'b' to branch to a particular time or the key 'r' to rewind to
the begin of the file.
When output is redirected to a file or pipe, atop prints all samples in
plain ASCII. The default line length is 80 characters in that case;
with the flag -L followed by an alternate line length, more (or less)
columns will be shown.
With the flag -b (begin time) and/or -e (end time) followed by a time
argument of the form [YYYYMMDD]hhmm, a certain time period within the
raw file can be selected.
Every day at midnight atop is restarted to write compressed binary data
to the file /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes
by default.
Furthermore all raw files are removed that are older than 28 days (by
default).
The mentioned default values can be overruled in the file /etc/de-
fault/atop that might contain other values for LOGOPTS (by default
without any flag), LOGINTERVAL (in seconds, by default 600), LOGGENERA-
TIONS (in days, by default 28), and LOGPATH (directory in which log-
files are stored).
Unfortunately, it is not always possible to keep the format of the raw
files compatible in newer versions of atop especially when lots of new
counters have to be maintained. Therefore, the program atopconvert is
installed to convert a raw file created by an older version of atop to
a raw file that can be read by a newer version of atop (see the man
page of atopconvert for more details).
OUTPUT DESCRIPTION
The first sample shows the system level activity since boot (the
elapsed time in the header shows the time since boot). Note that par-
ticular counters could have reached their maximum value (several times)
and started by zero again, so do not rely on these figures.
For every sample atop first shows the lines related to system level ac-
tivity. If a particular system resource has not been used during the
interval, the entire line related to this resource is suppressed. So
the number of system level lines may vary for each sample.
After that a list is shown of processes which have been active during
the last interval. This list is by default sorted on cpu consumption,
but this order can be changed by the keys which are previously de-
scribed.
If values have to be shown by atop which do not fit in the column
width, another format is used. If e.g. a cpu-consumption of 233216 mil-
liseconds should be shown in a column width of 4 positions, it is shown
as `233s' (in seconds). For large memory figures, another unit is cho-
sen if the value does not fit (Mb instead of Kb, Gb instead of Mb, Tb
instead of Gb, ...). For other values, a kind of exponent notation is
used (value 123456789 shown in a column of 5 positions gives 123e6).
OUTPUT DESCRIPTION - SYSTEM LEVEL
The system level information consists of the following output lines:
PRC Process and thread level totals.
This line contains the total cpu time consumed in system mode
(`sys') and in user mode (`user'), the total number of processes
present at this moment (`#proc'), the total number of threads
present at this moment in state `running' (`#trun'), `sleeping in-
terruptible' (`#tslpi') and `sleeping uninterruptible' (`#tslpu'),
the number of zombie processes (`#zombie'), the number of clone
system calls (`clones'), and the number of processes that ended
during the interval (`#exit') when process accounting is used. In-
stead of `#exit` the last column may indicate that process ac-
counting could not be activated (`no procacct`).
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
CPU CPU utilization.
At least one line is shown for the total occupation of all CPUs
together.
In case of a multi-processor system, an additional line is shown
for every individual processor (with `cpu' in lower case), sorted
on activity. Inactive CPUs will not be shown by default. The
lines showing the per-cpu occupation contain the cpu number in the
field combined with the wait percentage.
Every line contains the percentage of cpu time spent in kernel
mode by all active processes (`sys'), the percentage of cpu time
consumed in user mode (`user') for all active processes (including
processes running with a nice value larger than zero), the per-
centage of cpu time spent for interrupt handling (`irq') including
softirq, the percentage of unused cpu time while no processes were
waiting for disk I/O (`idle'), and the percentage of unused cpu
time while at least one process was waiting for disk I/O (`wait').
In case of per-cpu occupation, the cpu number and the wait per-
centage (`w') for that cpu. The number of lines showing the per-
cpu occupation can be limited.
For virtual machines, the steal-percentage (`steal') shows the
percentage of cpu time stolen by other virtual machines running on
the same hardware.
For physical machines hosting one or more virtual machines, the
guest-percentage (`guest') shows the percentage of cpu time used
by the virtual machines. Notice that this percentage overlaps the
user percentage!
When PMC performance monitoring counters are supported by the CPU
and the kernel (and atop runs with root privileges), the number of
instructions per CPU cycle (`ipc') is shown. The first sample al-
ways shows the value 'initial', because the counters are just ac-
tivated at the moment that atop is started.
When the CPU busy percentage is high and the IPC is less than 1.0,
it is likely that the CPU is frequently waiting for memory access
during instruction execution (larger CPU caches or faster memory
might be helpful to improve performance). When the CPU busy per-
centage is high and the IPC is greater than 1.0, it is likely that
the CPU is instruction-bound (more/faster cores might be helpful
to improve performance).
Furthermore, per CPU the effective number of cycles (`cycl') is
shown. This value can reach the current CPU frequency if such CPU
is 100% busy. When an idle CPU is halted, the number of effective
cycles can be (considerably) lower than the current frequency.
Notice that the average instructions per cycle and number of cy-
cles is shown in the CPU line for all CPUs.
Beware that reading the cycle counter in virtual machines (guests)
might introduce performance delays. Therefore this metric is by
default disabled in virtual machines. However, with the keyword
'perfevents' in the atoprc file this metric can be explicitly set
to 'enable' or 'disable' (see separate man-page of atoprc).
See also: http://www.brendangregg.com/blog/2017-05-09/cpu-utiliza-
tion-is-wrong.html
In case of frequency scaling, all previously mentioned CPU per-
centages are relative to the used scaling of the CPU during the
interval. If a CPU has been active for e.g. 50% in user mode dur-
ing the interval while the frequency scaling of that CPU was 40%,
only 20% of the full capacity of the CPU has been used in user
mode.
In case that the kernel module `cpufreq_stats' is active (after
issueing `modprobe cpufreq_stats'), the average frequency (`avgf')
and the average scaling percentage (`avgscal') is shown. Otherwise
the current frequency (`curf') and the current scaling percentage
(`curscal') is shown at the moment that the sample is taken. No-
tice that average values for frequency and scaling are shown in
the CPU line for every CPU.
Frequency scaling statistics are only gathered for systems with
maximum 8 CPUs, since gathering of these values per CPU is very
time consuming.
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
CPL CPU load information.
This line contains the load average figures reflecting the number
of threads that are available to run on a CPU (i.e. part of the
runqueue) or that are waiting for disk I/O. These figures are av-
eraged over 1 (`avg1'), 5 (`avg5') and 15 (`avg15') minutes.
Furthermore the number of context switches (`csw'), the number of
serviced interrupts (`intr') and the number of available CPUs are
shown.
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
GPU GPU utilization (Nvidia).
Read the section GPU STATISTICS GATHERING in this document to find
the details about the activation of the atopgpud daemon.
In the first column of every line, the bus-id (last nine charac-
ters) and the GPU number are shown. The subsequent columns show
the percentage of time that one or more kernels were executing on
the GPU (`gpubusy'), the percentage of time that global (device)
memory was being read or written (`membusy'), the occupation per-
centage of memory (`memocc'), the total memory (`total'), the mem-
ory being in use at the moment of the sample (`used'), the average
memory being in use during the sample time (`usavg'), the number
of processes being active on the GPU at the moment of the sample
(`#proc'), and the type of GPU.
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
The number of lines showing the GPUs can be limited.
MEM Memory occupation.
This line contains the total amount of physical memory (`tot'),
the amount of memory which is currently free (`free'), the amount
of memory in use as page cache including the total resident shared
memory (`cache'), the amount of memory within the page cache that
has to be flushed to disk (`dirty'), the amount of memory used for
filesystem meta data (`buff'), the amount of memory being used for
kernel mallocs (`slab'), the amount of slab memory that is re-
claimable (`slrec'), the resident size of shared memory including
tmpfs (`shmem`), the resident size of shared memory (`shrss`) the
amount of shared memory that is currently swapped (`shswp`), the
amount of memory that is currently claimed by vmware's balloon
driver (`vmbal`), the amount of memory that is currently claimed
by the ARC (cache) of ZFSonlinux (`zfarc`), the amount of memory
that is claimed for huge pages (`hptot`), the amount of huge page
memory that is really in use (`hpuse`), and the number of NUMA
nodes in this system (`numnode').
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
SWP Swap occupation and overcommit info.
This line contains the total amount of swap space on disk (`tot'),
the amount of free swap space (`free'), the size of the swap cache
(`swcac'), the total size of compressed storage in zswap
(`zpool`), the total size of the compressed pages stored in zswap
(`zstor'), the total size of the memory used for KSM (`ksuse`,
i.e. shared), and the total size of the memory saved (deduped) by
KSM (`kssav`, i.e. sharing).
Furthermore the committed virtual memory space (`vmcom') and the
maximum limit of the committed space (`vmlim', which is by default
swap size plus 50% of memory size) is shown. The committed space
is the reserved virtual space for all allocations of private mem-
ory space for processes. The kernel only verifies whether the com-
mitted space exceeds the limit if strict overcommit handling is
configured (vm.overcommit_memory is 2).
NUM Memory utilization per NUMA node.
This line shows the total amount of physical memory of this node
(`tot'), the amount of free memory (`free'), the amount of memory
for cached file data (`file'), modified cached file data
(`dirty'), recently used memory (`activ'), less recently used mem-
ory (`inact'), memory being used for kernel mallocs (`slab'), the
amount of slab memory that is reclaimable (`slrec'), shared memory
including tmpfs (`shmem'), total huge pages (`hptot') and the
fragmentation percentage (`frag').
NUC CPU utilization per NUMA node (not shown in case of a single NUMA
node).
This line shows the utilization percentages of all CPUs related to
this NUMA node, categorized for system mode (`sys'), user mode
(`user'), user mode for niced processes (`niced'), idle mode
(`idle'), wait mode (`w' preceded by the node number), irq mode
(`irq'), softirq mode (`sirq'), steal mode (`steal'), and guest
mode (`guest') overlapping user mode.
PAG Paging frequency.
This line contains the number of scanned pages (`scan') due to the
fact that free memory drops below a particular threshold, the num-
ber times that the kernel tries to reclaim pages due to an urgent
need (`stall'), the number of process stalls to run memory com-
paction to allocate huge pages (`compact'), the number of NUMA
pages migrated (`numamig'), and the total number of memory pages
migrated succesfully e.g. between NUMA nodes or for compaction
(`migrate') are shown.
Also the number of memory pages the system read from swap space
(`swin'), the number of memory pages the system wrote to swap
space (`swout'), and the number of out-of-memory kills
(`oomkill').
PSI Pressure Stall Information.
This line contains percentages about resource pressure related to
CPU, memory and I/O. Certain percentages refer to 'some' meaning
that some processes/threads were delayed due to resource overload.
Other percentages refer to 'full' meaning a loss of overall
throughput due to resource overload.
The values `cpusome', `memsome', `memfull', `iosome' and `iofull'
show the pressure percentage during the entire interval.
The values `cs' (cpu some), `ms' (memory some), `mf' (memory
full), `is' (I/O some) and `if' (I/O full) each show three per-
centages separated by slashes: pressure percentage over the last
10, 60 and 300 seconds.
LVM/MDD/DSK
Logical volume/multiple device/disk utilization.
Per active unit one line is produced, sorted on unit activity.
Such line shows the name (e.g. VolGroup00-lvtmp for a logical vol-
ume or sda for a hard disk), the busy percentage i.e. the portion
of time that the unit was busy handling requests (`busy'), the
number of read requests issued (`read'), the number of write re-
quests issued (`write'), the number of discard requests issued
(`discrd') if supported by kernel version, the number of KiBytes
per read (`KiB/r'), the number of KiBytes per write (`KiB/w'), the
number of KiBytes per discard (`KiB/d') if supported by kernel
version, the number of MiBytes per second throughput for reads
(`MBr/s'), the number of MiBytes per second throughput for writes
(`MBw/s'), the average queue depth (`avq') and the average number
of milliseconds needed by a request (`avio') for seek, latency and
data transfer.
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
The number of lines showing the units can be limited per class
(LVM, MDD or DSK) with the 'l' key or statically (see separate
man-page of atoprc). By specifying the value 0 for a particular
class, no lines will be shown any more for that class.
NFM Network Filesystem (NFS) mount at the client side.
For each NFS-mounted filesystem, a line is shown that contains the
mounted server directory, the name of the server (`srv'), the to-
tal number of bytes physically read from the server (`read') and
the total number of bytes physically written to the server
(`write'). Data transfer is subdivided in the number of bytes
read via normal read() system calls (`nread'), the number of bytes
written via normal read() system calls (`nwrit'), the number of
bytes read via direct I/O (`dread'), the number of bytes written
via direct I/O (`dwrit'), the number of bytes read via memory
mapped I/O pages (`mread'), and the number of bytes written via
memory mapped I/O pages (`mwrit').
NFC Network Filesystem (NFS) client side counters.
This line contains the number of RPC calls issues by local pro-
cesses (`rpc'), the number of read RPC calls (`read`) and write
RPC calls (`rpwrite') issued to the NFS server, the number of RPC
calls being retransmitted (`retxmit') and the number of authoriza-
tion refreshes (`autref').
NFS Network Filesystem (NFS) server side counters.
This line contains the number of RPC calls received from NFS
clients (`rpc'), the number of read RPC calls received (`cread`),
the number of write RPC calls received (`cwrit'), the number of
Megabytes/second returned to read requests by clients (`MBcr/s`),
the number of Megabytes/second passed in write requests by clients
(`MBcw/s`), the number of network requests handled via TCP
(`nettcp'), the number of network requests handled via UDP (`ne-
tudp'), the number of reply cache hits (`rchits'), the number of
reply cache misses (`rcmiss') and the number of uncached requests
(`rcnoca'). Furthermore some error counters indicating the number
of requests with a bad format (`badfmt') or a bad authorization
(`badaut'), and a counter indicating the number of bad clients
(`badcln').
NET Network utilization (TCP/IP).
One line is shown for activity of the transport layer (TCP and
UDP), one line for the IP layer and one line per active interface.
For the transport layer, counters are shown concerning the number
of received TCP segments including those received in error
(`tcpi'), the number of transmitted TCP segments excluding those
containing only retransmitted octets (`tcpo'), the number of UDP
datagrams received (`udpi'), the number of UDP datagrams transmit-
ted (`udpo'), the number of active TCP opens (`tcpao'), the number
of passive TCP opens (`tcppo'), the number of TCP output retrans-
missions (`tcprs'), the number of TCP input errors (`tcpie'), the
number of TCP output resets (`tcpor'), the number of UDP no ports
(`udpnp'), and the number of UDP input errors (`udpie').
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
These counters are related to IPv4 and IPv6 combined.
For the IP layer, counters are shown concerning the number of IP
datagrams received from interfaces, including those received in
error (`ipi'), the number of IP datagrams that local higher-layer
protocols offered for transmission (`ipo'), the number of received
IP datagrams which were forwarded to other interfaces (`ipfrw'),
the number of IP datagrams which were delivered to local higher-
layer protocols (`deliv'), the number of received ICMP datagrams
(`icmpi'), and the number of transmitted ICMP datagrams (`icmpo').
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
These counters are related to IPv4 and IPv6 combined.
For every active network interface one line is shown, sorted on
the interface activity. Such line shows the name of the interface
and its busy percentage in the first column. The busy percentage
for half duplex is determined by comparing the interface speed
with the number of bits transmitted and received per second; for
full duplex the interface speed is compared with the highest of
either the transmitted or the received bits. When the interface
speed can not be determined (e.g. for the loopback interface),
`---' is shown instead of the percentage.
Furthermore the number of received packets (`pcki'), the number of
transmitted packets (`pcko'), the line speed of the interface
(`sp'), the effective amount of bits received per second (`si'),
the effective amount of bits transmitted per second (`so'), the
number of collisions (`coll'), the number of received multicast
packets (`mlti'), the number of errors while receiving a packet
(`erri'), the number of errors while transmitting a packet
(`erro'), the number of received packets dropped (`drpi'), and the
number of transmitted packets dropped (`drpo').
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
The number of lines showing the network interfaces can be limited.
IFB Infiniband utilization.
For every active Infiniband port one line is shown, sorted on ac-
tivity. Such line shows the name of the port and its busy per-
centage in the first column. The busy percentage is determined by
taking the highest of either the transmitted or the received bits
during the interval, multiplying that value by the number of lanes
and comparing it against the maximum port speed.
Furthermore the number of received packets divided by the number
of lanes (`pcki'), the number of transmitted packets divided by
the number of lanes (`pcko'), the maximum line speed (`sp'), the
effective amount of bits received per second (`si'), the effective
amount of bits transmitted per second (`so'), and the number of
lanes (`lanes').
If the screen-width does not allow all of these counters, only a
relevant subset is shown.
The number of lines showing the Infiniband ports can be limited.
OUTPUT DESCRIPTION - PROCESS LEVEL
Following the system level information, the processes are shown from
which the resource utilization has changed during the last interval.
These processes might have used cpu time or issued disk or network re-
quests. However a process is also shown if part of it has been paged
out due to lack of memory (while the process itself was in sleep
state).
Per process the following fields may be shown (in alphabetical order),
depending on the current output mode as described in the section INTER-
ACTIVE COMMANDS and depending on the current width of your window:
AVGRSZ The average size of one read-action on disk.
AVGWSZ The average size of one write-action on disk.
BANDWI Total bandwidth for received TCP and UDP packets consumed by
this process (bits-per-second). This value can be compared
with the value `si' on interface level (used bandwidth per in-
terface).
This information will only be shown when the kernel module
`netatop' is loaded.
BANDWO Total bandwidth for sent TCP and UDP packets consumed by this
process (bits-per-second). This value can be compared with
the value `so' on interface level (used bandwidth per inter-
face).
This information will only be shown when the kernel module
`netatop' is loaded.
CID Container ID (Docker) of 12 hexadecimal digits, referring to
the container in which the process/thread is running. If a
process has been started and finished during the last inter-
val, a `?' is shown because the container ID is not part of
the standard process accounting record.
CMD The name of the process. This name can be surrounded by
"less/greater than" signs (`<name>') which means that the
process has finished during the last interval.
Behind the abbreviation `CMD' in the header line, the current
page number and the total number of pages of the
process/thread list are shown.
COMMAND-LINE
The full command line of the process (including arguments). If
the length of the command line exceeds the length of the
screen line, the arrow keys -> and <- can be used for horizon-
tal scroll.
Behind the verb `COMMAND-LINE' in the header line, the current
page number and the total number of pages of the
process/thread list are shown.
CPU The occupation percentage of this process related to the
available capacity for this resource on system level.
CPUNR The identification of the CPU the (main) thread is running on
or has recently been running on.
CTID Container ID (OpenVZ). If a process has been started and fin-
ished during the last interval, a `?' is shown because the
container ID is not part of the standard process accounting
record.
DSK The occupation percentage of this process related to the total
load that is produced by all processes (i.e. total disk ac-
cesses by all processes during the last interval).
This information is shown when per process "storage account-
ing" is active in the kernel.
EGID Effective group-id under which this process executes.
ENDATE Date that the process has been finished. If the process is
still running, this field shows `active'.
ENTIME Time that the process has been finished. If the process is
still running, this field shows `active'.
ENVID Virtual environment identified (OpenVZ only).
EUID Effective user-id under which this process executes.
EXC The exit code of a terminated process (second position of col-
umn `ST' is E) or the fatal signal number (second position of
column `ST' is S or C).
FSGID Filesystem group-id under which this process executes.
FSUID Filesystem user-id under which this process executes.
GPU When the atopgpud daemon does not run with root privileges,
the GPU percentage reflects the GPU memory occupation percent-
age (memory of all GPUs is 100%).
When the atopgpud daemon runs with root privileges, the GPU
percentage reflects the GPU busy percentage.
GPUBUSY Busy percentage on all GPUs (one GPU is 100%).
When the atopgpud daemon does not run with root privileges,
this value is not available.
GPUNUMS Comma-separated list of GPUs used by the process during the
interval. When the comma-separated list exceeds the width of
the column, a hexadecimal value is shown.
LOCKSZ The virtual amount of memory being locked (i.e. non-swappable)
by this process (or user).
MAJFLT The number of page faults issued by this process that have
been solved by creating/loading the requested memory page.
MEM The occupation percentage of this process related to the
available capacity for this resource on system level.
MEMAVG Average memory occupation during the interval on all used
GPUs.
MEMBUSY Busy percentage of memory on all GPUs (one GPU is 100%), i.e.
the time needed for read and write accesses on memory.
When the atopgpud daemon does not run with root privileges,
this value is not available.
MEMNOW Memory occupation at the moment of the sample on all used
GPUs.
MINFLT The number of page faults issued by this process that have
been solved by reclaiming the requested memory page from the
free list of pages.
NET The occupation percentage of this process related to the total
load that is produced by all processes (i.e. consumed network
bandwidth of all processes during the last interval).
This information will only be shown when kernel module `ne-
tatop' is loaded.
NICE The more or less static priority that can be given to a
process on a scale from -20 (high priority) to +19 (low prior-
ity).
NPROCS The number of active and terminated processes accumulated for
this user or program.
PID Process-id. If a process has been started and finished during
the last interval, a `?' is shown because the process-id is
not part of the standard process accounting record.
POLI The policies 'norm' (normal, which is SCHED_OTHER), 'btch'
(batch) and 'idle' refer to timesharing processes. The poli-
cies 'fifo' (SCHED_FIFO) and 'rr' (round robin, which is
SCHED_RR) refer to realtime processes.
PPID Parent process-id. If a process has been started and finished
during the last interval, value 0 is shown because the parent
process-id is not part of the standard process accounting
record.
PRI The process' priority ranges from 0 (highest priority) to 139
(lowest priority). Priority 0 to 99 are used for realtime pro-
cesses (fixed priority independent of their behavior) and pri-
ority 100 to 139 for timesharing processes (variable priority
depending on their recent CPU consumption and the nice value).
PSIZE The proportional memory size of this process (or user).
Every process shares resident memory with other processes.
E.g. when a particular program is started several times, the
code pages (text) are only loaded once in memory and shared by
all incarnations. Also the code of shared libraries is shared
by all processes using that shared library, as well as shared
memory and memory-mapped files. For the PSIZE calculation of
a process, the resident memory of a process that is shared
with other processes is divided by the number of sharers.
This means, that every process is accounted for a proportional
part of that memory. Accumulating the PSIZE values of all pro-
cesses in the system gives a reliable impression of the total
resident memory consumed by all processes.
Since gathering of all values that are needed to calculate the
PSIZE is a very time-consuming task, the 'R' key (or '-R'
flag) should be active. Gathering these values also requires
superuser privileges (otherwise '?K' is shown in the output).
If a process has finished during the last interval, no value
is shown since the proportional memory size is not part of the
standard process accounting record.
RDDSK When the kernel maintains standard io statistics (>= 2.6.20):
The read data transfer issued physically on disk (so reading
from the disk cache is not accounted for).
Unfortunately, the kernel aggregates the data tranfer of a
process to the data transfer of its parent process when termi-
nating, so you might see transfers for (parent) processes like
cron, bash or init, that are not really issued by them.
RDELAY Runqueue delay, i.e. time spent waiting on a runqueue.
RGID The real group-id under which the process executes.
RGROW The amount of resident memory that the process has grown dur-
ing the last interval. A resident growth can be caused by
touching memory pages which were not physically created/loaded
before (load-on-demand). Note that a resident growth can also
be negative e.g. when part of the process is paged out due to
lack of memory or when the process frees dynamically allocated
memory. For a process which started during the last interval,
the resident growth reflects the total resident size of the
process at that moment.
If a process has finished during the last interval, no value
is shown since resident memory occupation is not part of the
standard process accounting record.
RNET The number of TCP- and UDP packets received by this process.
This information will only be shown when kernel module `ne-
tatop' is installed.
If a process has finished during the last interval, no value
is shown since network counters are not part of the standard
process accounting record.
RSIZE The total resident memory usage consumed by this process (or
user). Notice that the RSIZE of a process includes all resi-
dent memory used by that process, even if certain memory parts
are shared with other processes (see also the explanation of
PSIZE).
If a process has finished during the last interval, no value
is shown since resident memory occupation is not part of the
standard process accounting record.
RTPR Realtime priority according the POSIX standard. Value can be
0 for a timesharing process (policy 'norm', 'btch' or 'idle')
or ranges from 1 (lowest) till 99 (highest) for a realtime
process (policy 'rr' or 'fifo').
RUID The real user-id under which the process executes.
S The current state of the (main) thread: `R' for running (cur-
rently processing or in the runqueue), `S' for sleeping inter-
ruptible (wait for an event to occur), `D' for sleeping non-
interruptible, `Z' for zombie (waiting to be synchronized with
its parent process), `T' for stopped (suspended or traced),
`W' for swapping, and `E' (exit) for processes which have fin-
ished during the last interval.
SGID The saved group-id of the process.
SNET The number of TCP and UDP packets transmitted by this process.
This information will only be shown when the kernel module
`netatop' is loaded.
ST The status of a process.
The first position indicates if the process has been started
during the last interval (the value N means 'new process').
The second position indicates if the process has been finished
during the last interval.
The value E means 'exit' on the process' own initiative; the
exit code is displayed in the column `EXC'.
The value S means that the process has been terminated unvol-
untarily by a signal; the signal number is displayed in the in
the column `EXC'.
The value C means that the process has been terminated unvol-
untarily by a signal, producing a core dump in its current di-
rectory; the signal number is displayed in the column `EXC'.
STDATE The start date of the process.
STTIME The start time of the process.
SUID The saved user-id of the process.
SWAPSZ The swap space consumed by this process (or user).
SYSCPU CPU time consumption of this process in system mode (kernel
mode), usually due to system call handling.
TCPRASZ The average size of a received TCP buffer in bytes. This in-
formation will only be shown when the kernel module `netatop'
is loaded.
TCPRCV The number of TCP packets received for this process. This in-
formation will only be shown when the kernel module `netatop'
is loaded.
TCPSASZ The average size of a transmitted TCP buffer in bytes. This
information will only be shown when the kernel module `ne-
tatop' is loaded.
TCPSND The number of TCP packets transmitted for this process. This
information will only be shown when the kernel module `ne-
tatop' is loaded.
THR Total number of threads within this process. All related
threads are contained in a thread group, represented by atop
as one line or as a separate line when the 'y' key (or -y
flag) is active.
On Linux 2.4 systems it is hardly possible to determine which
threads (i.e. processes) are related to the same thread group.
Every thread is represented by atop as a separate line.
TID Thread-id. All threads within a process run with the same PID
but with a different TID. This value is shown for individual
threads in multi-threaded processes (when using the key 'y').
TRUN Number of threads within this process that are in the state
'running' (R).
TSLPI Number of threads within this process that are in the state
'interruptible sleeping' (S).
TSLPU Number of threads within this process that are in the state
'uninterruptible sleeping' (D).
UDPRASZ The average size of a received UDP packet in bytes. This in-
formation will only be shown when the kernel module `netatop'
is loaded.
UDPRCV The number of UDP packets received by this process. This in-
formation will only be shown when the kernel module `netatop'
is loaded.
UDPSASZ The average size of a transmitted UDP packets in bytes. This
information will only be shown when the kernel module `ne-
tatop' is loaded.
UDPSND The number of UDP packets transmitted by this process. This
information will only be shown when the kernel module `ne-
tatop' is loaded.
USRCPU CPU time consumption of this process in user mode, due to pro-
cessing the own program text.
VDATA The virtual memory size of the private data used by this
process (including heap and shared library data).
VGROW The amount of virtual memory that the process has grown during
the last interval. A virtual growth can be caused by e.g. is-
sueing a malloc() or attaching a shared memory segment. Note
that a virtual growth can also be negative by e.g. issueing a
free() or detaching a shared memory segment. For a process
which started during the last interval, the virtual growth re-
flects the total virtual size of the process at that moment.
If a process has finished during the last interval, no value
is shown since virtual memory occupation is not part of the
standard process accounting record.
VPID Virtual process-id (within an OpenVZ container). If a process
has been started and finished during the last interval, a `?'
is shown because the virtual process-id is not part of the
standard process accounting record.
VSIZE The total virtual memory usage consumed by this process (or
user).
If a process has finished during the last interval, no value
is shown since virtual memory occupation is not part of the
standard process accounting record.
VSLIBS The virtual memory size of the (shared) text of all shared li-
braries used by this process.
VSTACK The virtual memory size of the (private) stack used by this
process
VSTEXT The virtual memory size of the (shared) text of the executable
program.
WCHAN Wait channel of thread in sleep state, i.e. the name of the
kernel function in which the thread has been put asleep.
Since determining the name string of the kernel function is a
relatively time-consuming task, the 'W' key (or '-W' flag)
should be active.
WRDSK When the kernel maintains standard io statistics (>= 2.6.20):
The write data transfer issued physically on disk (so writing
to the disk cache is not accounted for). This counter is
maintained for the application process that writes its data to
the cache (assuming that this data is physically transferred
to disk later on). Notice that disk I/O needed for swapping is
not taken into account.
Unfortunately, the kernel aggregates the data tranfer of a
process to the data transfer of its parent process when termi-
nating, so you might see transfers for (parent) processes like
cron, bash or init, that are not really issued by them.
WCANCL When the kernel maintains standard io statistics (>= 2.6.20):
The write data transfer previously accounted for this process
or another process that has been cancelled. Suppose that a
process writes new data to a file and that data is removed
again before the cache buffers have been flushed to disk.
Then the original process shows the written data as WRDSK,
while the process that removes/truncates the file shows the
unflushed removed data as WCANCL.
PARSEABLE OUTPUT
With the flag -P followed by a list of one or more labels (comma-sepa-
rated), parseable output is produced for each sample. The labels that
can be specified for system-level statistics correspond to the labels
(first verb of each line) that can be found in the interactive output:
"CPU", "cpu", "CPL", "GPU", "MEM", "SWP", "PAG", "PSI", "LVM", "MDD",
"DSK", "NFM", "NFC", "NFS", "NET", "IFB", "NUM" and "NUC".
For process-level statistics special labels are available: "PRG" (gen-
eral), "PRC" (cpu), "PRE" (GPU), "PRM" (memory), "PRD" (disk, only if
"storage accounting" is active) and "PRN" (network, only if the kernel
module 'netatop' has been installed).
With the label "ALL", all system and process level statistics are
shown.
The command and command line in the parseable output might contain spa-
ces and are therefore by default surrounded by parenthesis. However,
since a space is often used as separator between the fields by parsing
tools, with the additional flag -Z it is possible to exchange the spa-
ces in the command (line) by underscores and omit the parenthesis.
For every interval all requested lines are shown whereafter atop shows
a line just containing the label "SEP" as a separator before the lines
for the next sample are generated.
When a sample contains the values since boot, atop shows a line just
containing the label "RESET" before the lines for this sample are gen-
erated.
The first part of each output-line consists of the following six
fields: label (the name of the label), host (the name of this machine),
epoch (the time of this interval as number of seconds since 1-1-1970),
date (date of this interval in format YYYY/MM/DD), time (time of this
interval in format HH:MM:SS), and interval (number of seconds elapsed
for this interval).
The subsequent fields of each output-line depend on the label:
CPU Subsequent fields: total number of clock-ticks per second for
this machine, number of processors, consumption for all CPUs
in system mode (clock-ticks), consumption for all CPUs in user
mode (clock-ticks), consumption for all CPUs in user mode for
niced processes (clock-ticks), consumption for all CPUs in
idle mode (clock-ticks), consumption for all CPUs in wait mode
(clock-ticks), consumption for all CPUs in irq mode (clock-
ticks), consumption for all CPUs in softirq mode (clock-
ticks), consumption for all CPUs in steal mode (clock-ticks),
consumption for all CPUs in guest mode (clock-ticks) overlap-
ping user mode, frequency of all CPUs, frequency percentage of
all CPUs, instructions executed by all CPUs and cycles for all
CPUs.
cpu Subsequent fields: total number of clock-ticks per second for
this machine, processor-number, consumption for this CPU in
system mode (clock-ticks), consumption for this CPU in user
mode (clock-ticks), consumption for this CPU in user mode for
niced processes (clock-ticks), consumption for this CPU in
idle mode (clock-ticks), consumption for this CPU in wait mode
(clock-ticks), consumption for this CPU in irq mode (clock-
ticks), consumption for this CPU in softirq mode (clock-
ticks), consumption for this CPU in steal mode (clock-ticks),
consumption for this CPU in guest mode (clock-ticks) overlap-
ping user mode, frequency of this CPU, frequency percentage of
this CPU, instructions executed by this CPU and cycles for
this CPU.
CPL Subsequent fields: number of processors, load average for last
minute, load average for last five minutes, load average for
last fifteen minutes, number of context-switches, and number
of device interrupts.
GPU Subsequent fields: GPU number, bus-id string, type of GPU
string, GPU busy percentage during last second (-1 if not
available), memory busy percentage during last second (-1 if
not available), total memory size (KiB), used memory (KiB) at
this moment, number of samples taken during interval, cumula-
tive GPU busy percentage during the interval (to be divided by
the number of samples for the average busy percentage, -1 if
not available), cumulative memory busy percentage during the
interval (to be divided by the number of samples for the aver-
age busy percentage, -1 if not available), and cumulative mem-
ory occupation during the interval (to be divided by the num-
ber of samples for the average occupation).
MEM Subsequent fields: page size for this machine (in bytes), size
of physical memory (pages), size of free memory (pages), size
of page cache (pages), size of buffer cache (pages), size of
slab (pages), dirty pages in cache (pages), reclaimable part
of slab (pages), total size of vmware's balloon pages (pages),
total size of shared memory (pages), size of resident shared
memory (pages), size of swapped shared memory (pages), huge
page size (in bytes), total size of huge pages (huge pages),
size of free huge pages (huge pages), size of ARC (cache) of
ZFSonlinux (pages), size of sharing pages for KSM (pages), and
size of shared pages for KSM (pages).
SWP Subsequent fields: page size for this machine (in bytes), size
of swap (pages), size of free swap (pages), size of swap cache
(pages), size of committed space (pages), limit for committed
space (pages), size of the swap cache (pages), size of com-
pressed pages stored in zswap (pages), and total size of com-
pressed pool in zswap (pages).
PAG Subsequent fields: page size for this machine (in bytes), num-
ber of page scans, number of allocstalls, 0 (future use), num-
ber of swapins, number of swapouts, number of oomkills (-1
when counter not present), number of process stalls to run
memory compaction, number of pages successfully migrated in
total, and number of NUMA pages migrated.
PSI Subsequent fields: PSI statistics present on this system (n or
y), CPU some avg10, CPU some avg60, CPU some avg300, CPU some
accumulated microseconds during interval, memory some avg10,
memory some avg60, memory some avg300, memory some accumulated
microseconds during interval, memory full avg10, memory full
avg60, memory full avg300, memory full accumulated microsec-
onds during interval, I/O some avg10, I/O some avg60, I/O some
avg300, I/O some accumulated microseconds during interval, I/O
full avg10, I/O full avg60, I/O full avg300, and I/O full ac-
cumulated microseconds during interval.
LVM/MDD/DSK
For every logical volume/multiple device/hard disk one line is
shown.
Subsequent fields: name, number of milliseconds spent for I/O,
number of reads issued, number of sectors transferred for
reads, number of writes issued, number of sectors transferred
for write, number of discards issued (-1 if not supported),
and number of sectors transferred for discards.
NFM Subsequent fields: mounted NFS filesystem, total number of
bytes read, total number of bytes written, number of bytes
read by normal system calls, number of bytes written by normal
system calls, number of bytes read by direct I/O, number of
bytes written by direct I/O, number of pages read by memory-
mapped I/O, and number of pages written by memory-mapped I/O.
NFC Subsequent fields: number of transmitted RPCs, number of
transmitted read RPCs, number of transmitted write RPCs, num-
ber of RPC retransmissions, and number of authorization re-
freshes.
NFS Subsequent fields: number of handled RPCs, number of received
read RPCs, number of received write RPCs, number of bytes read
by clients, number of bytes written by clients, number of RPCs
with bad format, number of RPCs with bad authorization, number
of RPCs from bad client, total number of handled network re-
quests, number of handled network requests via TCP, number of
handled network requests via UDP, number of handled TCP con-
nections, number of hits on reply cache, number of misses on
reply cache, and number of uncached requests.
NET First, one line is produced for the upper layers of the TCP/IP
stack.
Subsequent fields: the verb "upper", number of packets re-
ceived by TCP, number of packets transmitted by TCP, number of
packets received by UDP, number of packets transmitted by UDP,
number of packets received by IP, number of packets transmit-
ted by IP, number of packets delivered to higher layers by IP,
number of packets forwarded by IP, number of input errors
(UDP), number of noport errors (UDP), number of active opens
(TCP), number of passive opens (TCP), number of passive opens
(TCP), number of established connections at this moment (TCP),
number of retransmitted segments (TCP), number of input errors
(TCP), and number of output resets (TCP).
Next, one line is shown for every interface.
Subsequent fields: name of the interface, number of packets
received by the interface, number of bytes received by the in-
terface, number of packets transmitted by the interface, num-
ber of bytes transmitted by the interface, interface speed,
and duplex mode (0=half, 1=full).
IFB Subsequent fields: name of the InfiniBand interface, port num-
ber, number of lanes, maximum rate (Mbps), number of bytes re-
ceived, number of bytes transmitted, number of packets re-
ceived, and number of packets transmitted.
NUM Subsequent fields: NUMA node number, page size for this ma-
chine (in bytes), the fragmentation percentage of this node,
size of physical memory (pages), size of free memory (pages),
recently (active) used memory (pages), less recently (inac-
tive) used memory (pages), size of cached file data (pages),
dirty pages in cache (pages), slab memory being used for ker-
nel mallocs (pages), slab memory that is reclaimable (pages),
shared memory including tmpfs (pages), and total huge pages
(pages).
NUC Subsequent fields: NUMA node number, number of processors for
this node, consumption for node CPUs in system mode (clock-
ticks), consumption for node CPUs in user mode (clock-ticks),
consumption for node CPUs in user mode for niced processes
(clock-ticks), consumption for node CPUs in idle mode (clock-
ticks), consumption for node CPUs in wait mode (clock-ticks),
consumption for node CPUs in irq mode (clock-ticks), consump-
tion for node CPUs in softirq mode (clock-ticks), consumption
for node CPUs in steal mode (clock-ticks), and consumption for
node CPUs in guest mode (clock-ticks) overlapping user mode.
PRG For every process one line is shown.
Subsequent fields: PID (unique ID of task), name (between
parenthesis or underscores for spaces), state, real uid, real
gid, TGID (group number of related tasks/threads), total num-
ber of threads, exit code (in case of fatal signal: signal
number + 256), start time (epoch), full command line (between
parenthesis or underscores for spaces), PPID, number of
threads in state 'running' (R), number of threads in state
'interruptible sleeping' (S), number of threads in state 'un-
interruptible sleeping' (D), effective uid, effective gid,
saved uid, saved gid, filesystem uid, filesystem gid, elapsed
time (hertz), is_process (y/n), OpenVZ virtual pid (VPID),
OpenVZ container id (CTID), Docker container id (CID), and in-
dication if the task is newly started during this interval
('N').
PRC For every process one line is shown.
Subsequent fields: PID, name (between parenthesis or under-
scores for spaces), state, total number of clock-ticks per
second for this machine, CPU-consumption in user mode (clock-
ticks), CPU-consumption in system mode (clockticks), nice
value, priority, realtime priority, scheduling policy, current
CPU, sleep average, TGID (group number of related
tasks/threads), is_process (y/n), runqueue delay in nanosec-
onds for this thread or for all threads (in case of process),
and wait channel of this thread (between parenthesis or under-
scores for spaces).
PRE For every process one line is shown.
Subsequent fields: PID, name (between parenthesis or under-
scores for spaces), process state, GPU state (A for active, E
for exited, N for no GPU user), number of GPUs used by this
process, bitlist reflecting used GPUs, GPU busy percentage
during interval, memory busy percentage during interval, mem-
ory occupation (KiB) at this moment cumulative memory occupa-
tion (KiB) during interval, and number of samples taken during
interval.
PRM For every process one line is shown.
Subsequent fields: PID, name (between parenthesis or under-
scores for spaces), state, page size for this machine (in
bytes), virtual memory size (Kbytes), resident memory size
(Kbytes), shared text memory size (Kbytes), virtual memory
growth (Kbytes), resident memory growth (Kbytes), number of
minor page faults, number of major page faults, virtual li-
brary exec size (Kbytes), virtual data size (Kbytes), virtual
stack size (Kbytes), swap space used (Kbytes), TGID (group
number of related tasks/threads), is_process (y/n), propor-
tional set size (Kbytes) if in 'R' option is specified and
virtually locked memory space (Kbytes).
PRD For every process one line is shown.
Subsequent fields: PID, name (between parenthesis or under-
scores for spaces), state, obsoleted kernel patch installed
('n'), standard io statistics used ('y' or 'n'), number of
reads on disk, cumulative number of sectors read, number of
writes on disk, cumulative number of sectors written, can-
celled number of written sectors, TGID (group number of re-
lated tasks/threads), obsoleted value ('n'), and is_process
(y/n).
If the standard I/O statistics (>= 2.6.20) are not used, the
disk I/O counters per process are not relevant. The counters
'number of reads on disk' and 'number of writes on disk' are
obsoleted anyhow.
PRN For every process one line is shown.
Subsequent fields: PID, name (between parenthesis or under-
scores for spaces), state, kernel module 'netatop' loaded ('y'
or 'n'), number of TCP-packets transmitted, cumulative size of
TCP-packets transmitted, number of TCP-packets received, cumu-
lative size of TCP-packets received, number of UDP-packets
transmitted, cumulative size of UDP-packets transmitted, num-
ber of UDP-packets received, cumulative size of UDP-packets
transmitted, number of raw packets transmitted (obsolete, al-
ways 0), number of raw packets received (obsolete, always 0),
TGID (group number of related tasks/threads) and is_process
(y/n).
If the kernel module is not active, the network I/O counters
per process are not relevant.
SIGNALS
By sending the SIGUSR1 signal to atop a new sample will be forced, even
if the current timer interval has not exceeded yet. The behavior is
similar to pressing the `t` key in an interactive session.
By sending the SIGUSR2 signal to atop a final sample will be forced af-
ter which atop will terminate.
EXAMPLES
To monitor the current system load interactively with an interval of 5
seconds:
atop 5
To monitor the system load and write it to a file (in plain ASCII) with
an interval of one minute during half an hour with active processes
sorted on memory consumption:
atop -M 60 30 > /log/atop.mem
Store information about the system and process activity in binary com-
pressed form to a file with an interval of ten minutes during an hour:
atop -w /tmp/atop.raw 600 6
View the contents of this file interactively:
atop -r /tmp/atop.raw
View the processor and disk utilization of this file in parseable for-
mat:
atop -PCPU,DSK -r /tmp/atop.raw
View the contents of today's standard logfile interactively:
atop -r
View the contents of the standard logfile of the day before yesterday
interactively:
atop -r yy
View the contents of the standard logfile of 2014, June 7 from 02:00 PM
onwards interactively:
atop -r 20140607 -b 1400
Concatenate all raw log files of January 2020 and generate parsable
output about the CPU utilization:
atopcat /var/log/atop/atop_202001?? | atop -r - -PCPU
FILES
/var/run/pacct_shadow.d/
Directory containing the process accounting shadow files that are
used by atop when the atopacctd daemon is active.
/var/cache/atop.d/atop.acct
File in which the kernel writes the accounting records when atop
itself has activated the process accounting mechanism.
/etc/atoprc
Configuration file containing system-wide default values. See re-
lated man-page.
~/.atoprc
Configuration file containing personal default values. See re-
lated man-page.
/etc/default/atop
Configuration file to overrule the settings of atop that runs in
the background to create the daily logfile. This file is created
when atop is installed. The default settings are:
LOGOPTS=""
LOGINTERVAL=600
LOGGENERATIONS=28
/var/log/atop/atop_YYYYMMDD
Raw file, where YYYYMMDD are digits representing the current date.
This name is used by atop running in the background as default
name for the output file, and by atop as default name for the in-
put file when using the -r flag.
All binary system and process level data in this file has been
stored in compressed format.
/var/run/netatop.log
File that contains the netpertask structs containing the network
counters of exited processes. These structs are written by the ne-
tatopd daemon and read by atop after reading the standard process
accounting records.
SEE ALSO
atopsar(1), atopconvert(1), atopcat(1), atoprc(5), atopacctd(8), ne-
tatop(4), netatopd(8), atopgpud(8), logrotate(8)
https://www.atoptool.nl
AUTHOR
Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
JC van Winkel
Linux December 2021 ATOP(1)