ATOP(1)                                                                                                                                ATOP(1)

NAME

       atop - AT Computing's System & Process Monitor

SYNOPSIS

       Interactive usage:

       atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o] [-C|-M|-D|-N|-A] [-af1x] [-L linelen] [-Plabel[,label]...]  [ interval [ samples ]]

       Writing and reading raw logfiles:

       atop -w rawfile [-a] [-S] [ interval [ samples ]]
       atop -r [ rawfile ] [-b hh:mm ] [-e hh:mm ] [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o] [-C|-M|-D|-N|-A] [-f1x] [-L linelen] [-Plabel[,label]...]

DESCRIPTION

       The  program  atop is an interactive monitor to view the load on a Linux system.  It shows the occupation of the most critical hardware
       resources (from a performance point of view) on system level, i.e. cpu, memory, disk and network.
       It also shows which processes are responsible for the indicated load with respect to cpu- and memory load on process level.  Disk  load
       is  shown if per process "storage accounting" is active in the kernel or if the kernel patch `cnt' has been installed.  Network load is
       only shown per process if the kernel patch `cnt' has been installed.

       Every interval (default: 10 seconds) information is shown about the resource occupation on system level (cpu, memory, disks and network
       layers),  followed  by a list of processes which have been active during the last interval (note that all processes that were unchanged
       during the last interval are not shown, unless the key 'a' has been pressed).  If the list of active processes does not entirely fit on
       the screen, only the top of the list is shown (sorted in order of activity).
       The  intervals  are  repeated  till the number of samples (specified as command argument) is reached, or till the key 'q' is pressed in
       interactive mode.

       When atop is started, it checks whether the standard output channel is connected to a screen, or to a file/pipe. In the first  case  it
       produces screen control codes (via the ncurses library) and behaves interactively; in the second case it produces flat ASCII-output.

       In interactive mode, the output of atop scales dynamically to the current dimensions of the screen/window.
       If  the window is resized horizontally, columns will be added or removed automatically. For this purpose, every column has a particular
       weight. The columns with the highest weigths that fit within the current width will be shown.
       If the window is resized vertically, lines of the process-list will be added or removed automatically.

       Furthermore in interactive mode the output of atop can be controlled by pressing particular keys.   However  it  is  also  possible  to
       specify such key as flag on the command line. In the latter case atop will switch to the indicated mode on beforehand; this mode can be
       modified again interactively. Specifying such key as flag is especially useful when running atop with output to a pipe  or  file  (non-
       interactively).  The flags used are the same as the keys which can be pressed in interactive mode (see section INTERACTIVE COMMANDS).
       Additional flags are available to support storage of atop-data in raw format (see section RAW DATA STORAGE).

PROCESS ACCOUNTING

       When  atop  is  started,  it  switches on the process accounting mechanism in the kernel. This forces the kernel to write a record with
       accounting information to the accounting file whenever a process ends.  Apart from the kernel administration  related  to  the  running
       processes,  atop  also  interprets the accounting records on disk with every interval; in this way atop can also show the activity of a
       process during the interval in which it is finished.
       Whenever the last incarnation of atop stops (either by pressing `q' or by `kill -15'), it switches off the process accounting mechanism
       again.  You  should  never  terminate  atop  by  `kill  -9',  because then it has no chance to stop process accounting; as a result the
       accounting file may consume a lot of disk space after a while.

       With the environment variable ATOPACCT the name of a specific process accounting file can be specified  (accounting  should  have  been
       activated  on  beforehand). When this environment variable is present but its contents is empty, process accounting will not be used at
       all.

       Notice that root-privileges are required to switch on process accounting in the kernel. You can start atop as root or  specify  setuid-
       root  privileges  to  the  executable  file.   In  the latter case, atop switches on process accounting and immediately drops the root-
       privileges again.

COLORS

       For the resource consumption on system level, atop uses colors to indicate that a critical  occupation  percentage  has  been  (almost)
       reached.   A  critical  occupation percentage means that is likely that this load causes a noticable negative performance influence for
       applications using this resource. The critical percentage depends on the type of resource: e.g. the performance  influence  of  a  disk
       with a busy percentage of 80% might be more noticable for applications/user than a CPU with a busy percentage of 90%.
       Currently atop uses the following default values to calculate a weighted percentage per resource:

        Processor
            A busy percentage of 90% or higher is considered `critical'.

        Disk
            A busy percentage of 70% or higher is considered `critical'.

        Network
            A busy percentage of 90% or higher for the load of an interface is considered `critical'.

        Memory
            An  occupation  percentage  of  90%  is  considered  `critical'.  Notice that this occupation percentage is the accumulated memory
            consumption of the kernel (including slab) and all processes; the memory for the page cache (`cache' and `buff' in  the  MEM-line)
            is not implied!
            If  the  number  of  pages  swapped  out (`swout' in the PAG-line) is larger than 10 per second, the memory resource is considered
            `critical'.  A value of at least 1 per second is considered `almost critical'.
            If the committed virtual memory exceeds the limit (`vmcom'  and  `vmlim'  in  the  SWP-line),  the  SWP-line  is  colored  due  to
            overcommitting the system.

        Swap
            An  occupation  percentage of 80% is considered `critical' because swap space might be completely exhausted in the near future; it
            is not critical from a performance point-of-view.

       These default values can be modified in the configuration file (see separate man-page of atoprc).

       When a resource exceeded its critical occupation percentage, the entire screen line is colored red.
       When a resource exceeded (default) 80% of its critical percentage (so it is almost critical), the entire screen line is  colored  cyan.
       This  `almost  critical  percentage'  (one value for all resources) can be modified in the configuration file (see separate man-page of
       atoprc).

       With the key 'x' (or flag -x), line coloring can be suppressed.

INTERACTIVE COMMANDS

       When running atop interactively (no output redirection), keys can be pressed to control the output. In general, lower case keys can  be
       used  to  show  other  information  for  the active processes and upper case keys can be used to influence the sort order of the active
       process list.

       g    Show generic output (default).

            Per process the following fields are shown in case of a window-width of 80 positions: process-id, cpu consumption during the  last
            interval in system- and user mode, the virtual and resident memory growth of the process.
            The  subsequent  columns  depend on the used kernel: When the kernel patch `cnt' has been installed, the number of read- and write
            transfers on disk, and the number of received and transmitted network packets are shown for each process.  When the  kernel  patch
            is  not  installed  and the kernel supports "storage accounting" (>= 2.6.20), the data transfer for read/write on disk, the status
            and exit code are shown for each process.  When the kernel patch is not  installed  and  the  kernel  does  not  support  "storage
            accounting", the username, number of threads in the thread group, the status and exit code are shown.
            The last columns contain the state, the occupation percentage for the choosen resource (default: cpu) and the process name.

            When more than 80 positions are available, other information is added.

       m    Show memory related output.

            Per  process  the following fields are shown in case of a window-width of 80 positions: process-id, minor and major memory faults,
            size of virtual shared text, total virtual process size, total resident process size, virtual  and  resident  growth  during  last
            interval, memory occupation percentage and process name.

            When more than 80 positions are available, other information is added.

       d    Show disk-related output.

            When  "storage  accounting"  is  active  in the kernel, the following fields are shown: process-id, amount of data read from disk,
            amount of data written to disk, amount of data that was written but has been withdrawn again (WCANCL), disk occupation  percentage
            and process name.

            When the kernel patch `cnt' is installed in the kernel, the following fields are shown: process-id, number of physical disk reads,
            average size per read (bytes), total size for read transfers, physical disk writes, average size per write (bytes), total size for
            write transfers, disk occupation percentage and process name.

       n    Show network related output.

            Per  process  the following fields are shown in case of a window-width of 80 positions: process-id, number of received TCP packets
            with the average size per packet (in bytes), number of sent TCP packets with the average size per packet  (in  bytes),  number  of
            received  UDP packets with the average size per packet (in bytes), number of sent UDP packets with the average size per packet (in
            bytes), and received and sent raw packets (e.g. ICMP) in one column, the network occupation percentage and process name.
            This information can only be shown when kernel patch `cnt' is installed.

            When more than 80 positions are available, other information is added.

       s    Show scheduling characteristics.

            Per process the following fields are shown in case of a window-width of 80 positions:  process-id,  number  of  threads  in  state
            'running' (R), number of threads in state 'interruptible sleeping' (S), number of threads in state 'uninterruptible sleeping' (D),
            scheduling policy (normal timesharing, realtime round-robin, realtime fifo), nice  value,  priority,  realtime  priority,  current
            processor, status, exit code, state, the occupation percentage for the choosen resource and the process name.

            When more than 80 positions are available, other information is added.

       v    Show various process characteristics.

            Per  process the following fields are shown in case of a window-width of 80 positions: process-id, user name and group, start date
            and time, status (e.g. exit code if the process has finished), state, the occupation percentage for the choosen resource  and  the
            process name.

            When more than 80 positions are available, other information is added.

       c    Show the command line of the process.

            Per  process  the  following fields are shown: process-id, the occupation percentage for the choosen resource and the command line
            including arguments.

       o    Show the user-defined line of the process.

            In the configuration file the keyword ownprocline can be specified with the description of a user-defined output-line.
            Refer to the man-page of atoprc for a detailed description.

       u    Show the process activity accumulated per user.

            Per user the following fields are shown: number of processes active or terminated during last interval (or in  total  if  combined
            with  command  `a'),  accumulated  cpu consumption during last interval in system- and user mode, the current virtual and resident
            memory space consumed by active processes (or all processes of the user if combined with command `a').
            When the kernel patch `cnt' has been installed or "storage accounting" is active, the accumulated read- and  write  throughput  on
            disk is shown.  When the kernel patch `cnt' has been installed, the number of received and sent network packets are shown.
            The last columns contain the accumulated occupation percentage for the choosen resource (default: cpu) and the user name.

       p    Show the process activity accumulated per program (i.e. process name).

            Per program the following fields are shown: number of processes active or terminated during last interval (or in total if combined
            with command `a'), accumulated cpu consumption during last interval in system- and user mode, the  current  virtual  and  resident
            memory space consumed by active processes (or all processes of the user if combined with command `a').
            When  the  kernel  patch `cnt' has been installed or "storage accounting" is active, the accumulated read- and write throughput on
            disk is shown.  When the kernel patch `cnt' has been installed, the number of received and sent network packets are shown.
            The last columns contain the accumulated occupation percentage for the choosen resource (default: cpu) and the program name.

       C    Sort the current list in the order of cpu consumption (default).  The one-but-last column changes to ``CPU''.

       M    Sort the current list in the order of resident memory consumption.  The one-but-last column changes to ``MEM''.

       D    Sort the current list in the order of disk accesses issued.  The one-but-last column changes to ``DSK''.

       N    Sort the current list in the order of network packets received/transmitted.  The one-but-last column changes to ``NET''.

       A    Sort the current list automatically in the order of the most busy system resource during this interval.  The  one-but-last  column
            shows  either  ``ACPU'',  ``AMEM'',  ``ADSK''  or  ``ANET''  (the preceding 'A' indicates automatic sorting-order).  The most busy
            resource is determined by comparing the weighted busy-percentages of the system resources, as described  earlier  in  the  section
            COLORS.
            This option remains valid until another sorting-order is explicitly selected again.
            A  sorting-order for disk is only possible when the kernel patch `cnt' is installed or "storage accounting" is active.  A sorting-
            order for network is only possible when the kernel patch `cnt' is installed.

       Miscellaneous interactive commands:

       ?    Request for help information (also the key 'h' can be pressed).

       V    Request for version information (version number and date).

       x    Suppress colors to highlight critical resources (toggle).
            Whether this key is active or not can be seen in the header line.

       z    The pause key can be used to freeze the current situation in order to investigate the output on the screen. While atop is  paused,
            the  keys described above can be pressed to show other information about the current list of processes.  Whenever the pause key is
            pressed again, atop will continue with a next sample.

       i    Modify the interval timer (default: 10 seconds). If an interval timer of 0 is entered, the interval timer is switched off. In that
            case a new sample can only be triggered manually by pressing the key 't'.

       t    Trigger  a new sample manually. This key can be pressed if the current sample should be finished before the timer has exceeded, or
            if no timer is set at all (interval timer defined as 0). In the latter case atop can be used as a stopwatch to  measure  the  load
            being caused by a particular application transaction, without knowing on beforehand how many seconds this transaction will last.

            When viewing the contents of a raw file, this key can be used to show the next sample from the file.

       T    When viewing the contents of a raw file, this key can be used to show the previous sample from the file.

       b    When  viewing the contents of a raw file, this key can be used to branch to a certain timestamp within the file (either forward or
            backward).

       r    Reset all counters to zero to see the system and process activity since boot again.

            When viewing the contents of a raw file, this key can be used to rewind to the beginning of the file again.

       U    Specify a search string for specific user names as a regular expression.  From now on, only (active) processes will be shown  from
            a  user  which  matches the regular expression.  The system statistics are still system wide.  If the Enter-key is pressed without
            specifying a name, active processes of all users will be shown again.
            Whether this key is active or not can be seen in the header line.

       P    Specify a search string for specific process names as a regular expression.  From now on, only processes will be shown with a name
            which  matches  the  regular  expression.   The  system  statistics  are  still  system wide.  If the Enter-key is pressed without
            specifying a name, all active processes will be shown again.
            Whether this key is active or not can be seen in the header line.

       a    The `all/active' key can be used to toggle between only showing/accumulating the  processes  that  were  active  during  the  last
            interval (default) or showing/accumulating all processes.
            Whether this key is active or not can be seen in the header line.

       f    Fixate  the  number  of  lines  for  system  resources (toggle).  By default only the lines are shown about system resources (cpu,
            paging, disk, network) that really have been active during the last interval.  With this key you can force atop to show  lines  of
            inactive resources as well.
            Whether this key is active or not can be seen in the header line.

       1    Show relevant counters as an average per second (in the format `..../s') instead of as a total during the interval (toggle).
            Whether this key is active or not can be seen in the header line.

       l    Limit  the  number  of system level lines for the counters per-cpu, the active disks and the network interfaces.  By default lines
            are shown of all cpu's, disks and network interfaces which have been active during the last interval.  Limiting these lines can be
            useful on systems with huge number cpu's, disks or interfaces in order to be able to run atop on a screen/window with e.g. only 24
            lines.
            For all mentioned resources the maximum number of lines can be specified interactively. When using the flag -l the maximum  number
            of  per-cpu lines is set to 0, the maximum number of disk lines to 5 and the maximum number of interface lines to 3.  These values
            can be modified again in interactive mode.

       k    Send a signal to an active process (a.k.a. kill a process).

       q    Quit the program.

       ^F   Show the next page of the process list (forward).

       ^B   Show the previous page of the process list (backward).

       ^L   Redraw the screen.

RAW DATA STORAGE

       In order to store system- and process level statistics for long-term analysis (e.g. to check the system load and the  active  processes
       running  yesterday  between 3:00 and 4:00 PM), atop can store the system- and process level statistics in compressed binary format in a
       raw file with the flag -w followed by the filename.  If this file already exists and is recognized as a raw data file, atop will append
       new  samples  to  the  file  (starting  with  a  sample which reflects the activity since boot); if the file does not exist, it will be
       created.
       By default only processes which have been active during the interval are stored in the raw file. When the flag  -a  is  specified,  all
       processes will be stored.
       The  interval (default: 10 seconds) and number of samples (default: infinite) can be passed as last arguments. Instead of the number of
       samples, the flag -S can be used to indicate that atop should finish anyhow before midnight.

       A raw file can be read and visualized again with the flag -r  followed  by  the  filename.  If  no  filename  is  specified,  the  file
       /var/log/atop.log  is  opened for input.  If a filename is specified in the format yyyymmdd (where yyyymmdd are digits representing any
       valid date), the file /var/log/atop/atop_yyyymmdd is opened.  If a filename with the symbolic name y is  specified,  yesterday's  daily
       logfile is opened (this can be repeated so 'yyyy' indicates the logfile of four days ago).
       The  samples  from  the file can be viewed interactively by using the key 't' to show the next sample, the key 'T' to show the previous
       sample, the key 'b' to branch to a particular time or the key 'r' to rewind to the begin of the file.
       When output is redirected to a file or pipe, atop prints all samples in plain ASCII. The default line length is 80 characters  in  that
       case; with the flag -L followed by an alternate line length, more (or less) columns will be shown.
       With  the flag -b (begin time) and/or -e (end time) followed by a time argument of the form HH:MM, a certain time period within the raw
       file can be selected.

       The Debian package automatically starts up atop via init, rotation of the logfiles is done with  logrotate.  Therefore,  the  suggested
       layout with cron scripts in /etc/atop as described in the upstream package is not necessary for Debian.

OUTPUT DESCRIPTION

       The  first  sample  shows  the  system level activity since boot (the elapsed time in the header shows the time since boot).  Note that
       particular counters could have reached their maximum value (several times) and started by zero again, so do not rely on these figures.

       For every sample atop first shows the lines related to system level activity. If a particular system resource has not been used  during
       the interval, the entire line related to this resource is suppressed. So the number of system level lines may vary for each sample.
       After  that  a  list  is  shown  of  processes  which  have been active during the last interval. This list is by default sorted on cpu
       consumption, but this order can be changed by the keys which are previously described.

       If values have to be shown by atop which do not fit in the column width, another notation is used. If e.g. a cpu-consumption of  233216
       milliseconds  should  be shown in a column width of 4 positions, it is shown as `233s' (in seconds).  For large memory figures, another
       unit is chosen if the value does not fit (Mb instead of Kb, Gb instead of Mb).  For other values, a kind of exponent notation  is  used
       (value 123456789 shown in a column of 5 positions gives 123e6).

OUTPUT DESCRIPTION - SYSTEM LEVEL

       The system level information consists of the following output lines:

       PRC  Process level totals.
            This  line  contains  the  total cpu time consumed in system mode (`sys') and in user mode (`user'), the total number of processes
            present at this moment (`#proc'), the total number of threads present at this  moment  in  state  `running'  (`#trun'),  `sleeping
            interruptible'  (`#tslpi')  and  `sleeping  uninterruptible' (`#tslpu'), the number of zombie processes (`#zombie'), the number of
            clone system calls (`clones'), and the number of processes that ended during the interval (`#exit', which  shows  `?'  if  process
            accounting is not used).
            If the screen-width does not allow all of these counters, only a relevant subset is shown.

       CPU  CPU utilization.
            At least one line is shown for the total occupation of all CPU's together.
            In case of a multi-processor system, an additional line is shown for every individual processor (with `cpu' in lower case), sorted
            on activity. Inactive cpu's will not be shown by default.  The lines showing the per-cpu occupation contain the cpu number in  the
            last field.

            Every  line  contains  the percentage of cpu time spent in kernel mode by all active processes (`sys'), the percentage of cpu time
            consumed in user mode (`user') for all active processes (including processes running with a nice  value  larger  than  zero),  the
            percentage  of  cpu  time  spent  for  interrupt  handling  (`irq')  including softirq, the percentage of unused cpu time while no
            processes were waiting for disk-I/O (`idle'), and the percentage of unused cpu time while at least one  process  was  waiting  for
            disk-I/O (`wait').
            In  case  of  per-cpu  occupation, the last column shows the cpu number and the wait percentage (`w') for that cpu.  The number of
            lines showing the per-cpu occupation can be limited.

            For virtual machines the steal-percentage is shown (`steal'), reflecting the percentage  of  cpu  time  stolen  by  other  virtual
            machines running on the same hardware.
            For  physical machines hosting one or more virtual machines, the guest-percentage is shown (`guest'), reflecting the percentage of
            cpu time used by the virtual machines.

            In case of frequency-scaling, all previously mentioned CPU-percentages are relative to the used scaling  of  the  CPU  during  the
            interval.   If  e.g.  a  CPU has been active for 50% in user mode during the interval while the frequency-scaling of that was 40%,
            then only 20% of the full capacity of the CPU has been used in user mode.
            In case that the kernel module `cpufreq_stats' is active (after issueing `modprobe cpufreq_stats'), the average frequency (`avgf')
            and  the  average  scaling  percentage  (`avgscal')  is  shown.  Otherwise  the current frequency (`curf') and the current scaling
            percentage (`curscal') is shown at the moment that the sample is taken.

            If the screen-width does not allow all of these counters, only a relevant subset is shown.

       CPL  CPU load information.
            This line contains the load average figures reflecting the number of threads that are available to run on a CPU (i.e. part of  the
            runqueue) or that are waiting for disk I/O. These figures are averaged over 1 (`avg1'), 5 (`avg5') and 15 (`avg15') minutes.
            Furthermore  the  number of context switches (`csw'), the number of serviced interrupts (`intr') and the number of available cpu's
            are shown.

            If the screen-width does not allow all of these counters, only a relevant subset is shown.

       MEM  Memory occupation.
            This line contains the total amount of physical memory (`tot'), the amount of memory which is currently free (`free'), the  amount
            of memory in use as page cache (`cache'), the amount of memory within the page cache that has to be flushed to disk (`dirty'), the
            amount of memory used for filesystem meta data (`buff') and the amount of memory being used for kernel malloc's (`slab' - always 0
            for kernel 2.4).

            If the screen-width does not allow all of these counters, only a relevant subset is shown.

       SWP  Swap occupation and overcommit info.
            This line contains the total amount of swap space on disk (`tot') and the amount of free swap space (`free').
            Furthermore  the  committed  virtual  memory  space  (`vmcom')  and the maximum limit of the committed space (`vmlim', which is by
            default swap size plus 50% of memory size) is shown.  The committed space is the reserved virtual space  for  all  allocations  of
            private  memory  space  for processes. The kernel only verifies whether the committed space exceeds the limit if strict overcommit
            handling is configured (vm.overcommit_memory is 2).

       PAG  Paging frequency.
            This line contains the number of scanned pages (`scan') due to the fact that free memory drops below a  particular  threshold  and
            the number times that the kernel tries to reclaim pages due to an urgent need (`stall').
            Also  the  number of memory pages the system read from swap space (`swin') and the number of memory pages the system wrote to swap
            space (`swout') are shown.

       LVM/MDD/DSK
            Logical volume/multiple device/disk utilization.
            Per active unit one line is produced, sorted on unit activity.  Such line shows the name  (e.g.  VolGroup00-lvtmp  for  a  logical
            volume  or  sda  for a hard disk), the busy percentage i.e. the portion of time that the unit was busy handling requests (`busy'),
            the number of read requests issued (`read'), the number of write requests  issued  (`write'),  the  number  of  KiBytes  per  read
            (`KiB/r'),  the number of KiBytes per write (`KiB/w'), the number of MiBytes per second throughput for reads (`MBr/s'), the number
            of MiBytes per second throughput for writes (`MBw/s'), the average queue depth (`avq') and  the  average  number  of  milliseconds
            needed by a request (`avio') for seek, latency and data transfer.
            If the screen-width does not allow all of these counters, only a relevant subset is shown.

            The number of lines showing the units can be limited per class (LVM, MDD or DSK) with the 'l' key or statically (see separate man-
            page of atoprc).  By specifying the value 0 for a particular class, no lines will be shown any more for that class.

       NET  Network utilization (TCP/IP).
            One line is shown for activity of the transport layer (TCP and UDP), one line for the IP layer and one line per active interface.
            For the transport layer, counters are shown concerning the number of received TCP  segments  including  those  received  in  error
            (`tcpi'),  the number of transmitted TCP segments excluding those containing only retransmitted octets (`tcpo'), the number of UDP
            datagrams received (`udpi'), the number of UDP datagrams transmitted (`udpo'), the number  of  active  TCP  opens  (`tcpao'),  the
            number  of  passive  TCP  opens  (`tcppo'),  the  number  of  TCP output retransmissions (`tcprs'), the number of TCP input errors
            (`tcpie'), the number of TCP output resets (`tcpie'), the number of TCP output retransmissions (`tcpor'), the  number  of  UDP  no
            ports (`udpnp'), and the number of UDP input errors (`tcpie').
            If the screen-width does not allow all of these counters, only a relevant subset is shown.
            These counters are related to IPv4 and IPv6 combined.

            For  the  IP layer, counters are shown concerning the number of IP datagrams received from interfaces, including those received in
            error (`ipi'), the number of IP datagrams that local higher-layer protocols  offered  for  transmission  (`ipo'),  the  number  of
            received IP datagrams which were forwarded to other interfaces (`ipfrw'), the number of IP datagrams which were delivered to local
            higher-layer protocols (`deliv'), the number of received ICMP datagrams (`icmpi'), and the number of  transmitted  ICMP  datagrams
            (`icmpo').
            If the screen-width does not allow all of these counters, only a relevant subset is shown.
            These counters are related to IPv4 and IPv6 combined.

            For every active network interface one line is shown, sorted on the interface activity.  Such line shows the name of the interface
            and its busy percentage in the first column.  The busy percentage for half duplex is determined by comparing the  interface  speed
            with  the  number of bits transmitted and received per second; for full duplex the interface speed is compared with the highest of
            either the transmitted or the received bits.  When the interface speed can not be determined (e.g. for  the  loopback  interface),
            `---' is shown instead of the percentage.
            Furthermore  the  number  of  received  packets (`pcki'), the number of transmitted packets (`pcko'), the effective amount of bits
            received per second (`si'), the effective amount of bits transmitted per second (`so'), the number  of  collisions  (`coll'),  the
            number  of received multicast packets (`mlti'), the number of errors while receiving a packet (`erri'), the number of errors while
            transmitting a packet (`erro'), the number of received packets dropped (`drpi'), and the number  of  transmitted  packets  dropped
            (`drpo').
            If the screen-width does not allow all of these counters, only a relevant subset is shown.
            The number of lines showing the network interfaces can be limited.

OUTPUT DESCRIPTION - PROCESS LEVEL

       Following  the  system  level  information,  the  processes  are  shown from which the resource utilization has changed during the last
       interval. These processes might have used cpu time or issued disk- or network requests. However a process is also shown if part  of  it
       has been paged out due to lack of memory (while the process itself was in sleep state).

       Per process the following fields may be shown (in alphabetical order), depending on the current output mode as described in the section
       INTERACTIVE COMMANDS and depending on the current width of your window:

       AVGRSZ   The average size of one read-action on disk.

       AVGWSZ   The average size of one write-action on disk.

       CMD      The name of the process.  This name can be surrounded by "less/greater than" signs (`<name>') which means that the process has
                finished during the last interval.
                Behind  the  abbreviation  `CMD' in the header line, the current page number and the total number of pages of the process list
                are shown.

       COMMAND-LINE
                The full command line of the process (including arguments), which is limited to the length of the  screen  line.   Th  command
                line  can  be  surrounded  by  "less/greater  than" signs (`<line>') which means that the process has finished during the last
                interval.
                Behind the verb `COMMAND-LINE' in the header line, the current page number and the total number of pages of the  process  list
                are shown.

       CPU      The occupation percentage of this process related to the available capacity for this resource on system level.

       CPUNR    The identification of the CPU the main thread of the process is running on or has recently been running on.

       DSK      The  occupation  percentage  of  this  process  related  to  the total load that is produced by all processes (i.e. total disk
                accesses by all processes during the last interval).
                This information is shown when per process "storage accounting" is active in the kernel or when the  kernel  patch  `cnt'  has
                been installed.

       EGID     Effective group-id under which this process executes.

       ENDATE   Date that the process has been finished. If the process is still running, this field shows `active'.

       ENTIME   Time that the process has been finished. If the process is still running, this field shows `active'.

       EUID     Effective user-id under which this process executes.

       EXC      The  exit  code  of  a terminated process (second position of column `ST' is E) or the fatal signal number (second position of
                column `ST' is S or C).

       FSGID    Filesystem group-id under which this process executes.

       FSUID    Filesystem user-id under which this process executes.

       MAJFLT   The number of page faults issued by this process that have been solved by creating/loading the requested memory page.

       MEM      The occupation percentage of this process related to the available capacity for this resource on system level.

       MINFLT   The number of page faults issued by this process that have been solved by reclaiming the requested memory page from  the  free
                list of pages.

       NET      The  occupation  percentage  of this process related to the total load that is produced by all processes (i.e. network packets
                transferred by all processes during the last interval).
                This information can only be shown when kernel patch `cnt' is installed.

       NICE     The more or less static priority that can be given to a proces on a scale from -20 (high priority) to +19 (low priority).

       NPROCS   The number of active and terminated processes accumulated for this user or program.

       PID      Process-id.  If a process has been started and finished during the last interval, a `?' is shown because the process-id is not
                part  of  the standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown
                properly.

       POLI     The policies 'norm' (normal, which is SCHED_OTHER), 'btch' (batch) and 'idle' refer to timesharing  processes.   The  policies
                'fifo' (SCHED_FIFO) and 'rr' (round robin, which is SCHED_RR) refer to realtime processes.

       PPID     Parent  process-id.   If a process has been started and finished during the last interval, value 0 is shown because the parent
                process-id is not part of the standard process accounting record.  However when the kernel patch  `acct'  is  installed,  this
                value will be shown properly.

       PRI      The  process'  priority  ranges  from  0  (highest  priority) to 139 (lowest priority). Priority 0 to 99 are used for realtime
                processes (fixed priority independent of their behavior) and priority 100 to 139 for timesharing processes (variable  priority
                depending on their recent CPU consumption and the nice value).

       RAWRCV   The  number  of  raw  datagrams  received  by  this  process.   This  information can only be shown when kernel patch `cnt' is
                installed.
                If a process has finished during the last interval, no value is shown  since  network  counters  are  not  registered  in  the
                standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       RAWSND   The number of raw datagrams sent by this process.  This information can only be shown when kernel patch `cnt' is installed.
                If  a  process  has  finished  during  the  last  interval, no value is shown since network counters are not registered in the
                standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       RDDSK    When the kernel maintains standard io statistics (>= 2.6.20):
                The read data transfer issued physically on disk (so reading from the disk cache is not accounted for).

                When the kernel patch `cnt' is installed:
                The number of read accesses issued physically on disk (so reading from the disk cache is not accounted for).

       RGID     The real group-id under which the process executes.

       RGROW    The amount of resident memory that the process has grown during the last interval. A resident growth can be caused by touching
                memory  pages  which  were  not  physically  created/loaded  before (load-on-demand).  Note that a resident growth can also be
                negative e.g. when part of the process is paged out due to lack of memory or when  the  process  frees  dynamically  allocated
                memory.   For  a  process  which started during the last interval, the resident growth reflects the total resident size of the
                process at that moment.
                If a process has finished during the last interval, no value is shown since resident memory occupation  is  not  part  of  the
                standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       RNET     The  number  of  TCP- and UDP packets received by this process.  This information can only be shown when kernel patch `cnt' is
                installed.
                If a process has finished during the last interval, no value is shown since network counters are  not  part  of  the  standard
                process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       RSIZE    The total resident memory usage consumed by this process (or user).
                If  a  process  has  finished  during the last interval, no value is shown since resident memory occupation is not part of the
                standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       RTPR     Realtime priority according the POSIX standard.  Value can be 0 for a timesharing process (policy 'norm', 'btch' or 'idle') or
                ranges from 1 (lowest) till 99 (highest) for a realtime process (policy 'rr' or 'fifo').

       RUID     The real user-id under which the process executes.

       S        The  current  state  of  the  main  thread  of the process: `R' for running (currently processing or in the runqueue), `S' for
                sleeping interruptible (wait for an event to occur), `D' for  sleeping  non-interruptible,  `Z'  for  zombie  (waiting  to  be
                synchronized  with  its parent process), `T' for stopped (suspended or traced), `W' for swapping, and `E' (exit) for processes
                which have finished during the last interval.

       SGID     The saved group-id of the process.

       SNET     The number of TCP- and UDP packets transmitted by this process.  This information can only be shown when kernel patch `cnt' is
                installed.
                If  a  process  has  finished  during the last interval, no value is shown since network-counters are not part of the standard
                process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       ST       The status of a process.
                The first position indicates if the process has been started during the last interval (the value N means 'new process').

                The second position indicates if the process has been finished during the last interval.
                The value E means 'exit' on the process' own initiative; the exit code is displayed in the column `EXC'.
                The value S means that the process has been terminated unvoluntarily by a signal; the signal number is displayed in the in the
                column `EXC'.
                The  value  C  means  that  the  process  has  been terminated unvoluntarily by a signal, producing a core dump in its current
                directory; the signal number is displayed in the column `EXC'.

       STDATE   The start date of the process.

       STTIME   The start time of the process.

       SUID     The saved user-id of the process.

       SYSCPU   CPU time consumption of this process in system mode (kernel mode), usually due to system call handling.

       TCPRASZ  The average size of a received TCP buffer in bytes (by the process).  This information can only be  shown  when  kernel  patch
                `cnt'  is  installed.   When  the  kernel  patch `acct' is installed as well, this value will also be shown when a process has
                finished during the last interval.

       TCPRCV   The number of receive requests issued by this process for TCP sockets.  This information can only be shown when  kernel  patch
                `cnt'  is  installed.   When  the  kernel  patch `acct' is installed as well, this value will also be shown when a process has
                finished during the last interval.

       TCPSASZ  The average size of a transmitted TCP buffer in bytes (by the process).  This information can only be shown when kernel  patch
                `cnt'  is  installed.   When  the  kernel  patch `acct' is installed as well, this value will also be shown when a process has
                finished during the last interval.

       TCPSND   The number of send requests issued by this process for TCP sockets,  and  the  average  size  per  transfer  in  bytes.   This
                information  can  only be shown when kernel patch `cnt' is installed.  When the kernel patch `acct' is installed as well, this
                value will also be shown when a process has finished during the last interval.

       THR      Total number of threads within this process.  All related threads are contained in a thread group, represented by atop as  one
                line.

                On  Linux  2.4 systems it is hardly possible to determine which threads (i.e. processes) are related to the same thread group.
                Every thread is represented by atop as a separate line.

       TOTRSZ   The total amount of data physically read from disk.  This information can only be shown when kernel patch `cnt' is installed.

       TOTWSZ   The total amount of data physically written to disk.  This information can only be shown when kernel patch `cnt' is installed.

       TRUN     Number of threads within this process that are in the state 'running' (R).

       TSLPI    Number of threads within this process that are in the state 'interruptible sleeping' (S).

       TSLPU    Number of threads within this process that are in the state 'uninterruptible sleeping' (D).

       UDPRASZ  The average size of a received UDP packet in bytes.  This information can only be shown when kernel patch `cnt' is  installed.
                When  the  kernel patch `acct' is installed as well, this value will also be shown when a process has finished during the last
                interval.

       UDPRCV   The number of receive requests issued by this process for UDP sockets.  This information can only be shown when  kernel  patch
                `cnt'  is  installed.   When  the  kernel  patch `acct' is installed as well, this value will also be shown when a process has
                finished during the last interval.

       UDPSASZ  The average size of a transmitted UDP packets in bytes.  This information can  only  be  shown  when  kernel  patch  `cnt'  is
                installed.   When  the  kernel  patch  `acct'  is installed as well, this value will also be shown when a process has finished
                during the last interval.

       UDPSND   The number of send requests issued by this process for TCP sockets,  and  the  average  size  per  transfer  in  bytes.   This
                information  can  only be shown when kernel patch `cnt' is installed.  When the kernel patch `acct' is installed as well, this
                value will also be shown when a process has finished during the last interval.

       USRCPU   CPU time consumption of this process in user mode, due to processing the own program text.

       VGROW    The amount of virtual memory that the process has grown during the last interval. A virtual  growth  can  be  caused  by  e.g.
                issueing  a  malloc() or attaching a shared memory segment. Note that a virtual growth can also be negative by e.g. issueing a
                free() or detaching a shared memory segment.  For a process which  started  during  the  last  interval,  the  virtual  growth
                reflects the total virtual size of the process at that moment.
                If  a  process  has  finished  during  the last interval, no value is shown since virtual memory occupation is not part of the
                standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       VSIZE    The total virtual memory usage consumed by this process (or user).
                If a process has finished during the last interval, no value is shown since virtual memory  occupation  is  not  part  of  the
                standard process accounting record.  However when the kernel patch `acct' is installed, this value will be shown.

       VSTEXT   The virtual memory size used by the shared text of this process.

       WRDSK    When the kernel maintains standard io statistics (>= 2.6.20):
                The  write  data  transfer  issued  physically  on  disk (so writing to the disk cache is not accounted for).  This counter is
                maintained for the application process that writes its data to the cache (assuming that this data is physically transferred to
                disk later on). Notice that disk I/O needed for swapping is not taken into account.

                When the kernel patch `cnt' is installed:
                The  number  of  write  accesses  issued  physically  on  disk  (so  writing  to the disk cache is not accounted for). Usually
                application processes just transfer their data to the cache, while the physical write accesses are done  later  on  by  kernel
                daemons  like  pdflush.   Note  that the number read- and write accesses are not separately maintained in the standard process
                accounting record.  This means that only one value is given for read's and write's in case a process has finished  during  the
                last interval.  However when the kernel patch `acct' is installed, these values will be shown separately.

       WCANCL   When the kernel patch `cnt' is not installed, but the kernel maintains standard io statistics (>= 2.6.20):
                The  write  data  transfer  previously  accounted for this process or another process that has been cancelled.  Suppose that a
                process writes new data to a file and that data is removed again before the cache buffers have been flushed to disk.  Then the
                original  process  shows  the  written  data  as  WRDSK, while the process that removes/truncates the file shows the unflushed
                removed data as WCANCL.

PARSEABLE OUTPUT

       With the flag -P followed by a list of one or more labels (comma-separated), parseable output is produced for each sample.  The  labels
       that  can  be  specified  for  system-level  statistics  correspond  to  the  labels (first verb of each line) that can be found in the
       interactive output: "CPU", "cpu" "CPL" "MEM", "SWP", "PAG", "LVM", "MDD", "DSK" and "NET".
       For process-level statistics special labels are introduced: "PRG" (general), "PRC" (cpu), "PRM" (memory),  "PRD"  (disk,  only  if  the
       kernel-patch has been installed) and "PRN" (network, only if the kernel-patch has been installed).
       With the label "ALL", all system- and process-level statistics are shown.

       For every interval all requested lines are shown whereafter atop shows a line just containing the label "SEP" as a separator before the
       lines for the next sample are generated.
       When a sample contains the values since boot, atop shows a line just containing the label "RESET" before the lines for this sample  are
       generated.

       The  first  part  of  each  output-line  consists  of  the  following six fields: label (the name of the label), host (the name of this
       machine), epoch (the time of this interval as number of seconds since 1-1-1970), date (date of this  interval  in  format  YYYY/MM/DD),
       time (time of this interval in format HH:MM:SS), and interval (number of seconds elapsed for this interval).

       The subsequent fields of each output-line depend on the label:

       CPU      Subsequent fields: total number of clock-ticks per second for this machine, number of processors, consumption for all CPU's in
                system mode (clock-ticks), consumption for all CPU's in user mode (clock-ticks), consumption for all CPU's in  user  mode  for
                niced  processes  (clock-ticks),  consumption for all CPU's in idle mode (clock-ticks), consumption for all CPU's in wait mode
                (clock-ticks), consumption for all CPU's in irq mode (clock-ticks), consumption for all CPU's in softirq  mode  (clock-ticks),
                consumption for all CPU's in steal mode (clock-ticks), and consumption for all CPU's in guest mode (clock-ticks).

       cpu      Subsequent  fields:  total  number  of  clock-ticks per second for this machine, processor-number, consumption for this CPU in
                system mode (clock-ticks), consumption for this CPU in user mode (clock-ticks), consumption for this  CPU  in  user  mode  for
                niced  processes  (clock-ticks),  consumption  for  this CPU in idle mode (clock-ticks), consumption for this CPU in wait mode
                (clock-ticks), consumption for this CPU in irq mode (clock-ticks), consumption for this CPU  in  softirq  mode  (clock-ticks),
                consumption for this CPU in steal mode (clock-ticks), and consumption for this CPU in guest mode (clock-ticks).

       CPL      Subsequent  fields:  number  of processors, load average for last minute, load average for last five minutes, load average for
                last fifteen minutes, number of context-switches, and number of device interrupts.

       MEM      Subsequent fields: page size for this machine (in bytes), size of physical memory (pages), size of free memory  (pages),  size
                of page cache (pages), size of buffer cache (pages), size of slab (pages), and number of dirty pages in cache.

       SWP      Subsequent  fields:  page  size  for this machine (in bytes), size of swap (pages), size of free swap (pages), 0 (future use),
                size of committed space (pages), and limit for committed space (pages).

       PAG      Subsequent fields: page size for this machine (in bytes), number of page scans, number of allocstalls, 0 (future use),  number
                of swapins, and number of swapouts.

       LVM/MDD/DSK
                For every logical volume/multiple device/hard disk one line is shown.
                Subsequent  fields:  name,  number  of  milliseconds  spent for I/O, number of reads issued, number of sectors transferred for
                reads, number of writes issued, and number of sectors transferred for write.

       NET      First one line is produced for the upper layers of the TCP/IP stack.
                Subsequent fields: the verb "upper", number of packets received by TCP, number  of  packets  transmitted  by  TCP,  number  of
                packets received by UDP, number of packets transmitted by UDP, number of packets received by IP, number of packets transmitted
                by IP, number of packets delivered to higher layers by IP, and number of packets forwarded by IP.

                Next one line is shown for every interface.
                Subsequent fields: name of the interface, number of packets received by  the  interface,  number  of  bytes  received  by  the
                interface,  number of packets transmitted by the interface, number of bytes transmitted by the interface, interface speed, and
                duplex mode (0=half, 1=full).

       PRG      For every process one line is shown.
                Subsequent fields: PID, name (between brackets), state, real uid, real gid, TGID (same as PID), total number of threads,  exit
                code,  start  time  (epoch),  full  command line (between brackets), PPID, number of threads in state 'running' (R), number of
                threads in state 'interruptible sleeping' (S), number of threads in  state  'uninterruptible  sleeping'  (D),  effective  uid,
                effective gid, saved uid, saved gid, filesystem uid, filesystem gid, and elapsed time (hertz).

       PRC      For every process one line is shown.
                Subsequent  fields:  PID,  name  (between  brackets),  state,  total  number  of clock-ticks per second for this machine, CPU-
                consumption in user mode (clockticks), CPU-consumption in system mode (clockticks), nice value, priority,  realtime  priority,
                scheduling policy, current CPU, and sleep average.

       PRM      For every process one line is shown.
                Subsequent  fields:  PID, name (between brackets), state, page size for this machine (in bytes), virtual memory size (Kbytes),
                resident memory size (Kbytes), shared text memory size (Kbytes),  virtual  memory  growth  (Kbytes),  resident  memory  growth
                (Kbytes), number of minor page faults, and number of major page faults.

       PRD      For every process one line is shown.
                Subsequent  fields: PID, name (between brackets), state, kernel-patch installed ('y' or 'n'), standard io statistics used ('y'
                or 'n'), number of reads on disk, cumulative number of sectors read, number of writes on disk, cumulative  number  of  sectors
                written, and cancelled number of written sectors.
                If  the  kernel  patch  is  not  installed and the standard I/O statistics (>= 2.6.20) are not used, the disk I/O counters per
                process are not relevant.  When the kernel patch is installed, the counter  'cancelled  number  of  written  sectors'  is  not
                relevant.   When  only  the  standard  io statistics are used, the counters 'number of reads on disk' and 'number of writes on
                disk' are not relevant.

       PRN      For every process one line is shown.
                Subsequent fields: PID,  name  (between  brackets),  state,  kernel-patch  installed  ('y'  or  'n'),  number  of  TCP-packets
                transmitted,  cumulative  size  of  TCP-packets  transmitted,  number  of TCP-packets received, cumulative size of TCP-packets
                received, number of UDP-packets transmitted, cumulative size of  UDP-packets  transmitted,  number  of  UDP-packets  received,
                cumulative size of UDP-packets transmitted, number of raw packets transmitted, and number of raw packets received.
                If the kernel patch is not installed, the network I/O counters per process are not relevant.

EXAMPLES

       To monitor the current system load interactively with an interval of 5 seconds:

         atop 5

       To  monitor  the  system  load  and  write it to a file (in plain ASCII) with an interval of one minute during half an hour with active
       processes sorted on memory consumption:

         atop -M 60 30 > /log/atop.mem

       Store information about the system- and process activity in binary compressed form to a file with an interval of ten minutes during  an
       hour:

         atop -w /tmp/atop.raw 600 6

       View the contents of this file interactively:

         atop -r /tmp/atop.raw

       View the processor- and disk-utilization of this file in parseable format:

         atop -PCPU,DSK -r /tmp/atop.raw

       View the contents of today's standard logfile interactively:

         atop -r

       View the contents of the standard logfile of the day before yesterday interactively:

         atop -r yy

       View the contents of the standard logfile of 2010, January 7 from 02:00 PM onwards interactively:

         atop -r 20100107 -b 14:00

FILES

       /tmp/atop.d/atop.acct
            File in which the kernel writes the accounting records if the standard accounting to the file /var/log/pacct or /var/account/pacct
            is not used.

       /etc/atoprc
            Configuration file containing system-wide default values.  See related man-page.

       ~/.atoprc
            Configuration file containing personal default values.  See related man-page.

       /var/log/atop.log[.X]
            Raw file, where X is the age in days as added by logrotate(1).  This name is used by atop as default name for the input file  when
            using the -r flag.
            All binary system- and process-level data in this file has been stored in compressed format.

SEE ALSO

       atopsar(1), atoprc(5), logrotate(8)
       http://www.atoptool.nl

AUTHOR

       Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
       JC van Winkel (jc@ATComputing.nl)
 

Hi, Guest!

This is a manual page collection for Linux and Unix-like operating system.

Features

  • Works with all browsers and mobile phones.
  • The HTML in this layout validates as XHTML 1.0 strict.

Links

Search this site