Atop
NAMN
atop - Avancerad system- och processövervakning ( Eng Advanced System & Process Monitor )
SYNOPSIS
Interactive Usage:
atop [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-afFG1xR] [-L linelen] [-Plabel[,label]... [-Z]] [ interval [
samples ]]
Writing and reading raw logfiles:
atop -w rawfile [-a] [-S] [ interval [ samples ]]
atop -r [ rawfile ] [-b [YYYYMMDD]hhmm ] [-e [YYYYMMDD]hhmm ] [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A]
[-fFG1xR] [-L linelen] [-Plabel[,label]... [-Z]]
BESKRIVNING
Programmet på toppen är en interaktiv bildskärm för att se belastningen på ett Linux-system. Det visar ockupationen av de mest kritiker
cal hårdvaruresurser (ur prestandasynpunkt) på systemnivå, d.v.s. cpu, minne, disk och nätverk.
Den visar också vilka processer som är ansvariga för den indikerade belastningen med avseende på cpu och minnesbelastning på processnivå.
Diskladdning visas per process om "lagringsredovisning" är aktivt i kärnan. Nätverksbelastning visas per process om
kärnmodulen `netatop' har installerats.
Startskärmen visar om ovanpå körs med begränsad vy (oprivilegierad) eller obegränsad vy (privilegierad). I fall att
begränsad vy ovanpå har inte behörighet (rotidentitet eller nödvändiga funktioner) för att hämta alla räknarvärden
på systemnivå och på processnivå.
Varje intervall (standard: 10 sekunder) visas information om resursockupationen på systemnivå (cpu, minne, diskar
och nätverkslager), följt av en lista över processer som har varit aktiva under det senaste intervallet (observera att alla pro-
cesser som var oförändrade under det senaste intervallet visas inte, såvida inte knappen 'a' har tryckts ned eller om inte sortering på
minnesuppsättning är klar). Om listan över aktiva processer inte passar helt på skärmen, bara toppen av listan
visas (sorterad i aktivitetsordning).
Intervallerna upprepas tills antalet sampel (anges som kommandoargument) nås, eller tills tangenten 'q' trycks ned i interaktivt läge. När atop startas kontrollerar den om standardutgångskanalen är ansluten till en skärm eller till en fil/pipe. I den
det första fallet producerar skärmkontrollkoder (via ncurses-biblioteket) och beter sig interaktivt; i det andra fallet producerar den platt ASCII-utgång.
I interaktivt läge skalas utsignalen från toppen dynamiskt till skärmens/fönstrets nuvarande dimensioner.
Om storleken på fönstret ändras horisontellt kommer kolumner att läggas till eller tas bort automatiskt. För detta ändamål har varje kolumn en
speciell vikt. Kolumnerna med de högsta vikterna som passar inom den aktuella bredden kommer att visas.
Om storleken på fönstret ändras vertikalt kommer rader i process-/trådlistan att läggas till eller tas bort automatiskt.
Dessutom i interaktivt läge kan utmatningen av atop styras genom att trycka på speciella tangenter. Men det är också möjligt att ange en sådan nyckel som flagga på kommandoraden. I så fall växlar atop till det indikerade läget på i förväg; detta
läge kan ändras igen interaktivt. Att ange en sådan nyckel som flagga är särskilt användbart när man kör ovanpå med utgång till
ett rör eller en fil (icke-interaktivt). Dessa flaggor är desamma som de tangenter som kan tryckas in i interaktivt läge (se avsnittet INTERAKTIVA KOMMANDON).
Ytterligare flaggor är tillgängliga för att stödja lagring av atop-data i råformat (se avsnittet RAW DATA STORAGE).
PROCESS ACCOUNTING
With every interval, atop reads the kernel administration to obtain information about all running processes. However, it is likely that during the interval also processes have terminated. These processes might have consumed system resources during this interval as well before they terminated. Therefor, atop tries to read the process accounting records that contain the accounting information of terminated processes and report these processes too. Only when the process accounting mechanism in the kernel is activated, the kernel writes such process accounting record to a file for every process that terminates.
There are various ways for atop to get access to the process accounting records (tried in this order):
1. When the environment variable ATOPACCT is set, it specifies the name of the process accounting file. In that case,
process accounting for this file should have been activated on beforehand. Before opening this file for reading, atop
drops its root privileges (if any).
When this environment variable is present but its contents is empty, process accounting will not be used at all.
2. This is the preferred way of handling process accounting records!
When the atopacctd daemon is active, it has activated the process accounting mechanism in the kernel and transfers to
original accounting records to shadow files. In that case, atop drops its root privileges and opens the current shadow
file for reading.
This way is preferred, because the atopacctd daemon maintains full control of the size of the original process account‐
ing file written by the kernel and the shadow files read by the atop process(es).
The atopacct service will be activated before the atop service to enable atop to detect that process accounting is man‐
aged by the atopacctd daemon. As a forking service, atopacctd takes care that all directories and files are initialized
before the parent process dies. The child process continues as the daemon process.
For further information, refer to the atopacctd man page.
3. When the atopacctd daemon is not active, atop verifies if the process accounting mechanism has been switched on via the
separate psacct or acct package (the package name depends on the Linux distro). In that case, one of the files
/var/log/pacct, /var/account/pacct or /var/log/account/pacct is in use as process accounting file and atop opens this
file for reading.
4. As a last possibility, atop itself tries to activate the process accounting mechanism (requires root privileges) using
the file /var/cache/atop.d/atop.acct (to be written by the kernel, to be read by atop itself). Process accounting re‐
mains active as long as at least one atop process is alive. Whenever the last atop process stops (either by pressing
`q' or by `kill -15'), it deactivates the process accounting mechanism again. Therefor you should never terminate atop
by `kill -9', because then it has no chance to stop process accounting. As a result, the accounting file may consume a
lot of disk space after a while.
To avoid that the process accounting file consumes too much disk space, atop verifies at the end of every sample if the
size of the process accounting file exceeds 200 MiB and if this atop process is the only one that is currently using
the file. In that case the file is truncated to a size of zero.
Notice that root-privileges are required to switch on/off process accounting in the kernel. You can start atop as a
root user or specify setuid-root privileges to the executable file. In the latter case, atop switches on process ac‐
counting and drops the root-privileges again.
If atop does not run with root-privileges, it does not show information about finished processes. It indicates this
situation with the message message `no procacct` in the top-right corner (instead of the counter that shows the number
of exited processes). When during one interval a lot of processes have finished, atop might grow tremendously in memory when reading all process accounting records at the end of the interval. To avoid such excessive growth, atop will never read more than 50 MiB with
process information from the process accounting file per interval (approx. 70000 finished processes). In interactive mode
a warning is given whenever processes have been skipped for this reason.
COLORS
For the resource consumption on system level, atop uses colors to indicate that a critical occupation percentage has been
(almost) reached. A critical occupation percentage means that is likely that this load causes a noticeable negative per‐
formance influence for applications using this resource. The critical percentage depends on the type of resource: e.g. the
performance influence of a disk with a busy percentage of 80% might be more noticeable for applications/user than a CPU
with a busy percentage of 90%.
Currently atop uses the following default values to calculate a weighted percentage per resource:
Processor
A busy percentage of 90% or higher is considered `critical'.
Disk
A busy percentage of 70% or higher is considered `critical'.
Network
A busy percentage of 90% or higher for the load of an interface is considered `critical'.
Memory
An occupation percentage of 90% is considered `critical'. Notice that this occupation percentage is the accumulated
memory consumption of the kernel (including slab) and all processes; the memory for the page cache (`cache' and `buff'
in the MEM-line) and the reclaimable part of the slab (`slrec`) is not implied!
If the number of pages swapped out (`swout' in the PAG-line) is larger than 10 per second, the memory resource is con‐
sidered `critical'. A value of at least 1 per second is considered `almost critical'.
If the committed virtual memory exceeds the limit (`vmcom' and `vmlim' in the SWP-line), the SWP-line is colored due
to overcommitting the system.
Swap
An occupation percentage of 80% is considered `critical' because swap space might be completely exhausted in the near
future; it is not critical from a performance point-of-view.
These default values can be modified in the configuration file (see separate man-page of atoprc).
When a resource exceeds its critical occupation percentage, the concerning values in the screen line are colored red by de‐
fault.
When a resource exceeded (default) 80% of its critic With the key 'x' (or flag -x), the use of colors can be suppressed.
NETATOP MODULE
Per-process and per-thread network activity can be measured by the netatop kernel module. You can download this kernel mod‐
ule from the website (mentioned at the end of this manual page) and install it on your system if the kernel version is
2.6.24 or newer.
When atop gathers counters for a new interval, it verifies if the netatop module is currently active. If so, atop obtains
the relevant network counters from this module and shows the number of sent and received packets per process/thread in the
generic screen. Besides, detailed counters can be requested by pressing the `n' key.
When the netatopd daemon is running as well, atop also reads the network counters of exited processes that are logged by
this daemon (comparable with process accounting).
More information about the optional netatop kernel module and the netatopd daemon can be found in the concerning man-pages
and on the website mentioned at the end of this manual page.
al percentage (so it is almost critical), the concerning values in the
screen line are colored cyan by default. This `almost critical percentage' (one value for all resources) can be modified in
the configuration file (see separate man-page of atoprc).
The default colors red and cyan can be modified in the configuration file as well (see separate man-page of atoprc).
GPU STATISTICS GATHERING
GPU statistics can be gathered by atopgpud which is a separate data collection daemon process. It gathers cumulative uti‐
lization counters of every Nvidia GPU in the system, as well as utilization counters of every process that uses a GPU.
When atop notices that the daemon is active, it reads these GPU utilization counters with every interval.
The atopgpud daemon is written in Python, so a Python interpreter should be installed on the target system. The Python code
of the daemon is compatible with Python version 2 and version 3. For the gathering of the statistics, the pynvml module is
used by the daemon. Be sure that this module is installed on the target system before activating the daemon, by running the
command as root pip (the command pip might be exchanged by pip3 in case of Python3):
pip install nvidia-ml-py
The atopgpud daemon is installed by default as part of the atop package, but it is not automatically enabled. The daemon
can be enabled and started now by running the following commands (as root):
systemctl enable atopgpu
systemctl start atopgpu
Find a description about the utilization counters in the section OUTPUT DESCRIPTION.
INTERACTIVE COMMANDS
When running atop interactively (no output redirection), keys can be pressed to control the output. In general, lower case
keys can be used to show other information for the active processes and upper case keys can be used to influence the sort
order of the active process/thread list.
g Show generic output (default).
Per process the following fields are shown in case of a window-width of 80 positions: process-id, cpu consumption dur‐
ing the last interval in system and user mode, the virtual and resident memory growth of the process.
The subsequent columns depend on the used kernel:
When the kernel supports "storage accounting" (>= 2.6.20), the data transfer for read/write on disk, the status and
exit code are shown for each process. When the kernel does not support "storage accounting", the username, number of
threads in the thread group, the status and exit code are shown.
When the kernel module 'netatop' is loaded, the data transfer for send/receive of network packets is shown for each
process.
The last columns contain the state, the occupation percentage for the chosen resource (default: cpu) and the process
name.
When more than 80 positions are available, other information is added.
m Show memory related output.
Per process the following fields are shown in case of a window-width of 80 positions: process-id, minor and major mem‐
ory faults, size of virtual shared text, total virtual process size, total resident process size, virtual and resident
growth during last interval, memory occupation percentage and process name.
When more than 80 positions are available, other information is added.
For memory consumption, always all processes are shown (also the processes that were not active during the interval).
d Show disk-related output.
When "storage accounting" is active in the kernel, the following fields are shown: process-id, amount of data read
from disk, amount of data written to disk, amount of data that was written but has been withdrawn again (WCANCL), disk
occupation percentage and process name.
n Show network related output.
Per process the following fields are shown in case of a window-width of 80 positions: process-id, thread-id, total
bandwidth for received packets, total bandwidth for sent packets, number of received TCP packets with the average size
per packet (in bytes), number of sent TCP packets with the average size per packet (in bytes), number of received UDP
packets with the average size per packet (in bytes), number of sent UDP packets with the average size per packet (in
bytes), the network occupation percentage and process name.
This information can only be shown when kernel module `netatop' is installed.
When more than 80 positions are available, other information is added.
s Show scheduling characteristics.
Per process the following fields are shown in case of a window-width of 80 positions: process-id, number of threads in
state 'running' (R), number of threads in state 'interruptible sleeping' (S), number of threads in state 'uninterrupt‐
ible sleeping' (D), scheduling policy (normal timesharing, realtime round-robin, realtime fifo), nice value, priority,
realtime priority, current processor, status, exit code, state, the occupation percentage for the chosen resource and
the process name.
When more than 80 positions are available, other information is added.
v Show various process characteristics.
Per process the following fields are shown in case of a window-width of 80 positions: process-id, user name and group,
start date and time, status (e.g. exit code if the process has finished), state, the occupation percentage for the
chosen resource and the process name.
When more than 80 positions are available, other information is added.
c Show the command line of the process.
Per process the following fields are shown: process-id, the occupation percentage for the chosen resource and the com‐
mand line including arguments.
e Show GPU utilization.
Per process at least the following fields are shown: process-id, range of GPU numbers on which the process currently
runs, GPU busy percentage on all GPUs, memory busy percentage (i.e. read and write accesses on memory) on all GPUs,
memory occupation at the moment of the sample, average memory occupation during the sample, and GPU percentage.
When the atopgpud daemon does not run with root privileges, the GPU busy percentage and the memory busy percentage are
not available on process level. In that case, the GPU percentage on process level reflects the GPU memory occupation
instead of the GPU busy percentage (which is preferred).
o Show the user-defined line of the process.
In the configuration file the keyword ownprocline can be specified with the description of a user-defined output-line.
Refer to the man-page of atoprc for a detailed description.
y Show the individual threads within a process (toggle).
Single-threaded processes are still shown as one line.
For multi-threaded processes, one line represents the process while additional lines show the activity per individual
thread (in a different color). Depending on the option 'a' (all or active toggle), all threads are shown or only the
threads that were active during the last interval. Depending on the option 'Y' (sort threads), the threads per
process will be sorted on the chosen sort criterium or not.
Whether this key is active or not can be seen in the header line.
Y Sort the threads per process when combined with option 'y' (toggle).
u Show the process activity accumulated per user.
Per user the following fields are shown: number of processes active or terminated during last interval (or in total if
combined with command `a'), accumulated cpu consumption during last interval in system and user mode, the current vir‐
tual and resident memory space consumed by active processes (or all processes of the user if combined with command
`a').
When "storage accounting" is active in the kernel, the accumulated read and write throughput on disk is shown. When
the kernel module `netatop' has been installed, the number of received and sent network packets are shown.
The last columns contain the accumulated occupation percentage for the chosen resource (default: cpu) and the user
name.
p Show the process activity accumulated per program (i.e. process name).
Per program the following fields are shown: number of processes active or terminated during last interval (or in total
if combined with command `a'), accumulated cpu consumption during last interval in system and user mode, the current
virtual and resident memory space consumed by active processes (or all processes of the user if combined with command
`a').
When "storage accounting" is active in the kernel, the accumulated read and write throughput on disk is shown. When
the kernel module `netatop' has been installed, the number of received and sent network packets are shown.
The last columns contain the accumulated occupation percentage for the chosen resource (default: cpu) and the program
name.
j Show the process activity accumulated per Docker container.
Per container the following fields are shown: number of processes active or terminated during last interval (or in to‐
tal if combined with command `a'), accumulated cpu consumption during last interval in system and user mode, the cur‐
rent virtual and resident memory space consumed by active processes (or all processes of the user if combined with
command `a').
When "storage accounting" is active in the kernel, the accumulated read and write throughput on disk is shown. When
the kernel module `netatop' has been installed, the number of received and sent network packets are shown.
The last columns contain the accumulated occupation percentage for the chosen resource (default: cpu) and the Docker
container id (CID).
C Sort the current list in the order of cpu consumption (default). The one-but-last column changes to ``CPU''.
E Sort the current list in the order of GPU utilization (preferred, but only applicable when the atopgpud daemon runs
under root privileges) or the order of GPU memory occupation). The one-but-last column changes to ``GPU''.
M Sort the current list in the order of resident memory consumption. The one-but-last column changes to ``MEM''. In
case of sorting on memory, the full process list will be shown (not only the active processes).
D Sort the current list in the order of disk accesses issued. The one-but-last column changes to ``DSK''.
N Sort the current list in the order of network bandwidth (received and transmitted). The one-but-last column changes
to ``NET''.
A Sort the current list automatically in the order of the most busy system resource during this interval. The one-but-
last column shows either ``ACPU'', ``AMEM'', ``ADSK'' or ``ANET'' (the preceding 'A' indicates automatic sorting-or‐
der). The most busy resource is determined by comparing the weighted busy-percentages of the system resources, as de‐
scribed earlier in the section COLORS.
This option remains valid until another sorting-order is explicitly selected again.
A sorting-order for disk is only possible when "storage accounting" is active. A sorting-order for network is only
possible when the kernel module `netatop' is loaded.
Miscellaneous interactive commands:
? Request for help information (also the key 'h' can be pressed).
V Request for version information (version number and date).
R Gather and calculate the proportional set size of processes (toggle). Gathering of all values that are needed to cal‐
culate the PSIZE of a process is a very time-consuming task, so this key should only be active when analyzing the res‐
ident memory consumption of processes.
W Get the WCHAN per thread (toggle). Gathering of the WCHAN string per thread is a relatively time-consuming task, so
this key should only be made active when analyzing the reason for threads to be in sleep state.
x Suppress colors to highlight critical resources (toggle).
Whether this key is active or not can be seen in the header line.
z The pause key can be used to freeze the current situation in order to investigate the output on the screen. While atop
is paused, the keys described above can be pressed to show other information about the current list of processes.
Whenever the pause key is pressed again, atop will continue with a next sample.
i Modify the interval timer (default: 10 seconds). If an interval timer of 0 is entered, the interval timer is switched
off. In that case a new sample can only be triggered manually by pressing the key 't'.
t Trigger a new sample manually. This key can be pressed if the current sample should be finished before the timer has
exceeded, or if no timer is set at all (interval timer defined as 0). In the latter case atop can be used as a stop‐
watch to measure the load being caused by a particular application transaction, without knowing on beforehand how many
seconds this transaction will last.
When viewing the contents of a raw file this key can be used to show the next sample from the file. This key can also
be used when viewing raw data via a pipe.
T When viewing the contents of a raw file this key can be used to show the previous sample from the file, however not
when reading raw data from a pipe.
b When viewing the contents of a raw file, this key can be used to branch to a certain timestamp within the file either
forward or backward. When viewing raw data from a pipe only forward branches are possible.
r Reset all counters to zero to see the system and process activity since boot again.
When viewing the contents of a raw file, this key can be used to rewind to the beginning of the file again (except
when reading raw data from a pipe).
U Specify a search string for specific user names as a regular expression. From now on, only (active) processes will be
shown from a user which matches the regular expression. The system statistics are still system wide. If the Enter-
key is pressed without specifying a name, (active) processes of all users will be shown again.
Whether this key is active or not can be seen in the header line.
I Specify a list with one or more PIDs to be selected. From now on, only processes will be shown with a PID which
matches one of the given list. The system statistics are still system wide. If the Enter-key is pressed without
specifying a PID, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
P Specify a search string for specific process names as a regular expression. From now on, only processes will be shown
with a name which matches the regular expression. The system statistics are still system wide. If the Enter-key is
pressed without specifying a name, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
/ Specify a specific command line search string as a regular expression. From now on, only processes will be shown with
a command line which matches the regular expression. The system statistics are still system wide. If the Enter-key
is pressed without specifying a string, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
J Specify a Docker container id of 12 (hexadecimal) characters. From now on, only processes will be shown that run in
that specific Docker container (CID). The system statistics are still system wide. If the Enter-key is pressed with‐
out specifying a container id, all (active) processes will be shown again.
Whether this key is active or not can be seen in the header line.
Q Specify a comma-separated list of process/thread state characters. From now on, only processes/threads will be shown
that are in those specific states. Accepted states are: R (running), S (sleeping), D (disk sleep), I (idle), T
(stopped), t (tracing stop), X (dead), Z (zombie) and P (parked). The system statistics are still system wide. If
the Enter-key is pressed without specifying a state, all (active) processes/threads will be shown again.
Whether this key is active or not can be seen in the header line.
S Specify search strings for specific logical volume names, specific disk names and specific network interface names.
All search strings are interpreted as a regular expressions. From now on, only those system resources are shown that
match the concerning regular expression. If the Enter-key is pressed without specifying a search string, all (active)
system resources of that type will be shown again.
Whether this key is active or not can be seen in the header line.
a The `all/active' key can be used to toggle between only showing/accumulating the processes that were active during the
last interval (default) or showing/accumulating all processes.
Whether this key is active or not can be seen in the header line.
G By default, atop shows/accumulates the processes that are alive and the processes that are exited during the last in‐
terval. With this key (toggle), showing/accumulating the processes that are exited can be suppressed.
Whether this key is active or not can be seen in the header line.
f Show a fixed (maximum) number of header lines for system resources (toggle). By default only the lines are shown
about system resources (CPUs, paging, logical volumes, disks, network interfaces) that really have been active during
the last interval. With this key you can force atop to show lines of inactive resources as well.
Whether this key is active or not can be seen in the header line.
F Suppress sorting of system resources (toggle). By default system resources (CPUs, logical volumes, disks, network in‐
terfaces) are sorted on utilization.
Whether this key is active or not can be seen in the header line.
1 Show relevant counters as an average per second (in the format `..../s') instead of as a total during the interval
(toggle). Whether this key is active or not can be seen in the header line.
l Limit the number of system level lines for the counters per-cpu, the active disks and the network interfaces. By de‐
fault lines are shown of all CPUs, disks and network interfaces which have been active during the last interval. Lim‐
iting these lines can be useful on systems with huge number CPUs, disks or interfaces in order to be able to run atop
on a screen/window with e.g. only 24 lines.
For all mentioned resources the maximum number of lines can be specified interactively. When using the flag -l the
maximum number of per-cpu lines is set to 0, the maximum number of disk lines to 5 and the maximum number of interface
lines to 3. These values can be modified again in interactive mode.
k Send a signal to an active process (a.k.a. kill a process).
q Quit the program.
PgDn Show the next page of the process/thread list.
With the arrow-down key the list can be scrolled downwards with single lines.
^F Show the next page of the process/thread list (forward).
With the arrow-down key the list can be scrolled downwards with single lines.
PgUp Show the previous page of the process/thread list.
With the arrow-up key the list can be scrolled upwards with single lines.
^B Show the previous page of the process/thread list (backward).
With the arrow-up key the list can be scrolled upwards with single lines.
k Send a signal to an active process (a.k.a. kill a process).
q Quit the program.
PgDn Show the next page of the process/thread list.
With the arrow-down key the list can be scrolled downwards with single lines.
^F Show the next page of the process/thread list (forward).
With the arrow-down key the list can be scrolled downwards with single lines.
PgUp Show the previous page of the process/thread list.
With the arrow-up key the list can be scrolled upwards with single lines.
^B Show the previous page of the process/thread list (backward).
With the arrow-up key the list can be scrolled upwards with single lines.
^L Redraw the screen.
RAW DATA STORAGE
In order to store system and process level statistics for long-term analysis (e.g. to check the system load and the active
processes running yesterday between 3:00 and 4:00 PM), atop can store the system and process level statistics in compressed
binary format in a raw file with the flag -w followed by the filename. If this file already exists and is recognized as a
raw data file, atop will append new samples to the file (starting with a sample which reflects the activity since boot); if
the file does not exist, it will be created.
All information about processes and threads is stored in the raw file.
The interval (default: 10 seconds) and number of samples (default: infinite) can be passed as last arguments. Instead of
the number of samples, the flag -S can be used to indicate that atop should finish anyhow before midnight.
A raw file can be read and visualized again with the flag -r followed by the filename. If no filename is specified, the
file /var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are digits representing the current date). If a file‐
name is specified in the format YYYYMMDD (representing any valid date), the file /var/log/atop/atop_YYYYMMDD is opened. If
a filename with the symbolic name y is specified, yesterday's daily logfile is opened (this can be repeated so 'yyyy' indi‐
cates the logfile of four days ago). If the filename - is used, stdin will be read.
The samples from the file can be viewed interactively by using the key 't' to show the next sample, the key 'T' to show the
previous sample, the key 'b' to branch to a particular time or the key 'r' to rewind to the begin of the file.
When output is redirected to a file or pipe, atop prints all samples in plain ASCII. The default line length is 80 charac‐
ters in that case; with the flag -L followed by an alternate line length, more (or less) columns will be shown.
With the flag -b (begin time) and/or -e (end time) followed by a time argument of the form [YYYYMMDD]hhmm, a certain time
period within the raw file can be selected.
Every day at midnight atop is restarted to write compressed binary data to the file /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes by default.
Furthermore all raw files are removed that are older than 28 days (by default).
The mentioned default values can be overruled in the file /etc/default/atop that might contain other values for LOGOPTS (by
default without any flag), LOGINTERVAL (in seconds, by default 600), LOGGENERATIONS (in days, by default 28), and LOGPATH
(directory in which logfiles are stored).
Unfortunately, it is not always possible to keep the format of the raw files compatible in newer versions of atop espe‐
cially when lots of new counters have to be maintained. Therefore, the program atopconvert is installed to convert a raw
file created by an older version of atop to a raw file that can be read by a newer version of atop (see the man page of
atopconvert for more details).
OUTPUT DESCRIPTION
The first sample shows the system level activity since boot (the elapsed time in the header shows the time since boot).
Note that particular counters could have reached their maximum value (several times) and started by zero again, so do not
rely on these figures.
For every sample atop first shows the lines related to system level activity. If a particular system resource has not been
used during the interval, the entire line related to this resource is suppressed. So the number of system level lines may
vary for each sample.
After that a list is shown of processes which have been active during the last interval. This list is by default sorted on
cpu consumption, but this order can be changed by the keys which are previously described.
If values have to be shown by atop which do not fit in the column width, another format is used. If e.g. a cpu-consumption
of 233216 milliseconds should be shown in a column width of 4 positions, it is shown as `233s' (in seconds). For large
memory figures, another unit is chosen if the value does not fit (Mb instead of Kb, Gb instead of Mb, Tb instead of Gb,
...). For other values, a kind of exponent notation is used (value 123456789 shown in a column of 5 positions gives
123e6).
OUTPUT DESCRIPTION - SYSTEM LEVEL
The system level information consists of the following output lines:
PRC Process and thread level totals.
This line contains the total cpu time consumed in system mode (`sys') and in user mode (`user'), the total number of
processes present at this moment (`#proc'), the total number of threads present at this moment in state `running'
(`#trun'), `sleeping interruptible' (`#tslpi') and `sleeping uninterruptible' (`#tslpu'), the number of zombie pro‐
cesses (`#zombie'), the number of clone system calls (`clones'), and the number of processes that ended during the in‐
terval (`#exit') when process accounting is used. Instead of `#exit` the last column may indicate that process ac‐
counting could not be activated (`no procacct`).
If the screen-width does not allow all of these counters, only a relevant subset is shown.
CPU CPU utilization.
At least one line is shown for the total occupation of all CPUs together.
In case of a multi-processor system, an additional line is shown for every individual processor (with `cpu' in lower
case), sorted on activity. Inactive CPUs will not be shown by default. The lines showing the per-cpu occupation con‐
tain the cpu number in the field combined with the wait percentage.
Every line contains the percentage of cpu time spent in kernel mode by all active processes (`sys'), the percentage of
cpu time consumed in user mode (`user') for all active processes (including processes running with a nice value larger
than zero), the percentage of cpu time spent for interrupt handling (`irq') including softirq, the percentage of un‐
used cpu time while no processes were waiting for disk I/O (`idle'), and the percentage of unused cpu time while at least one process was waiting for disk I/O (`wait'). In case of per-cpu occupation, the cpu number and the wait percentage (`w') for that cpu. The number of lines showing
the per-cpu occupation can be limited.
For virtual machines, the steal-percentage (`steal') shows the percentage of cpu time stolen by other virtual machines
running on the same hardware.
For physical machines hosting one or more virtual machines, the guest-percentage (`guest') shows the percentage of cpu
time used by the virtual machines. Notice that this percentage overlaps the user percentage!
When PMC performance monitoring counters are supported by the CPU and the kernel (and atop runs with root privileges),
the number of instructions per CPU cycle (`ipc') is shown. The first sample always shows the value 'initial', because the counters are just activated at the moment that atop is started. When the CPU busy percentage is high and the IPC is less than 1.0, it is likely that the CPU is frequently waiting for memory access during instruction execution (larger CPU caches or faster memory might be helpful to improve performance). When the CPU busy percentage is high and the IPC is greater than 1.0, it is likely that the CPU is instruction-bound (more/faster cores might be helpful to improve performance). Furthermore, per CPU the effective number of cycles (`cycl') is shown. This value can reach the current CPU frequency if such CPU is 100% busy. When an idle CPU is halted, the number of effective cycles can be (considerably) lower than the current frequency. Notice that the average instructions per cycle and number of cycles is shown in the CPU line for all CPUs.
Beware that reading the cycle counter in virtual machines (guests) might introduce performance delays. Therefore this metric is by default disabled in virtual machines. However, with the keyword 'perfevents' in the atoprc file this metric can be explicitly set to 'enable' or 'disable' (see separate man-page of atoprc).
See also: http://www.brendangregg.com/blog/2017-05-09/cpu-utilization-is-wrong.html
In case of frequency scaling, all previously mentioned CPU percentages are relative to the used scaling of the CPU during the interval. If a CPU has been active for e.g. 50% in user mode during the interval while the frequency scaling of that CPU was 40%, only 20% of the full capacity of the CPU has been used in user mode.
In case that the kernel module `cpufreq_stats' is active (after issueing `modprobe cpufreq_stats'), the average frequency (`avgf') and the average scaling percentage (`avgscal') is shown. Otherwise the current frequency (`curf') and the current scaling percentage (`curscal') is shown at the moment that the sample is taken. Notice that average values for frequency and scaling are shown in the CPU line for every CPU.
Frequency scaling statistics are only gathered for systems with maximum 8 CPUs, since gathering of these values per
CPU is very time consuming. If the screen-width does not allow all of these counters, only a relevant subset is shown.