Provided by: atop_1.26-0ubuntu1_amd64 bug

NAME

       atop - AT Computing's System & Process Monitor

SYNOPSIS

       Interactive usage:

       atop     [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o]    [-C|-M|-D|-N|-A]    [-af1x]    [-L    linelen]
       [-Plabel[,label]...]  [ interval [ samples ]]

       Writing and reading raw logfiles:

       atop -w rawfile [-a] [-S] [ interval [ samples ]]
       atop  -r  [  rawfile  ]  [-b  hh:mm  ]   [-e   hh:mm   ]   [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o]
       [-C|-M|-D|-N|-A] [-f1x] [-L linelen] [-Plabel[,label]...]

DESCRIPTION

       The  program  atop is an interactive monitor to view the load on a Linux system.  It shows
       the occupation of the most critical hardware resources (from a performance point of  view)
       on system level, i.e. cpu, memory, disk and network.
       It  also shows which processes are responsible for the indicated load with respect to cpu-
       and memory load on process level.  Disk load is shown if per process "storage  accounting"
       is  active in the kernel or if the kernel patch `cnt' has been installed.  Network load is
       only shown per process if the kernel patch `cnt' has been installed.

       Every interval (default: 10 seconds) information is shown about the resource occupation on
       system  level  (cpu,  memory,  disks  and network layers), followed by a list of processes
       which have been active during the  last  interval  (note  that  all  processes  that  were
       unchanged  during  the  last interval are not shown, unless the key 'a' has been pressed).
       If the list of active processes does not entirely fit on the screen, only the top  of  the
       list is shown (sorted in order of activity).
       The  intervals  are repeated till the number of samples (specified as command argument) is
       reached, or till the key 'q' is pressed in interactive mode.

       When atop is started, it checks whether the standard output  channel  is  connected  to  a
       screen,  or  to  a  file/pipe. In the first case it produces screen control codes (via the
       ncurses library) and behaves interactively; in the second case  it  produces  flat  ASCII-
       output.

       In  interactive  mode,  the output of atop scales dynamically to the current dimensions of
       the screen/window.
       If the window is resized horizontally, columns will be added or removed automatically. For
       this  purpose,  every column has a particular weight. The columns with the highest weigths
       that fit within the current width will be shown.
       If the window is resized vertically, lines of the process-list will be  added  or  removed
       automatically.

       Furthermore  in  interactive  mode  the  output  of  atop  can  be  controlled by pressing
       particular keys.  However it is also possible to specify such key as flag on  the  command
       line.  In  the latter case atop will switch to the indicated mode on beforehand; this mode
       can be modified again interactively. Specifying such key as flag is especially useful when
       running  atop  with  output to a pipe or file (non-interactively).  The flags used are the
       same as the keys which can  be  pressed  in  interactive  mode  (see  section  INTERACTIVE
       COMMANDS).
       Additional  flags are available to support storage of atop-data in raw format (see section
       RAW DATA STORAGE).

PROCESS ACCOUNTING

       When atop is started, it switches on the process accounting mechanism in the kernel.  This
       forces  the  kernel  to  write a record with accounting information to the accounting file
       whenever a process ends.  Apart from the kernel  administration  related  to  the  running
       processes,  atop  also  interprets  the accounting records on disk with every interval; in
       this way atop can also show the activity of a process during the interval in which  it  is
       finished.
       Whenever  the last incarnation of atop stops (either by pressing `q' or by `kill -15'), it
       switches off the process accounting mechanism again. You should never  terminate  atop  by
       `kill  -9',  because  then  it  has  no chance to stop process accounting; as a result the
       accounting file may consume a lot of disk space after a while.

       With the environment variable ATOPACCT the name of a specific process accounting file  can
       be  specified (accounting should have been activated on beforehand). When this environment
       variable is present but its contents is empty, process accounting will not be used at all.

       Notice that root-privileges are required to switch on process accounting  in  the  kernel.
       You  can  start atop as root or specify setuid-root privileges to the executable file.  In
       the latter case, atop switches on process  accounting  and  immediately  drops  the  root-
       privileges again.

COLORS

       For the resource consumption on system level, atop uses colors to indicate that a critical
       occupation percentage has been (almost) reached.  A critical occupation  percentage  means
       that  is  likely  that  this  load  causes  a noticable negative performance influence for
       applications using this resource. The critical percentage depends on the type of resource:
       e.g.  the  performance  influence  of  a  disk with a busy percentage of 80% might be more
       noticable for applications/user than a CPU with a busy percentage of 90%.
       Currently atop uses the following default values to calculate a  weighted  percentage  per
       resource:

        Processor
            A busy percentage of 90% or higher is considered `critical'.

        Disk
            A busy percentage of 70% or higher is considered `critical'.

        Network
            A  busy  percentage  of  90%  or  higher  for  the load of an interface is considered
            `critical'.

        Memory
            An  occupation  percentage  of  90%  is  considered  `critical'.   Notice  that  this
            occupation  percentage is the accumulated memory consumption of the kernel (including
            slab) and all processes; the memory for the page cache (`cache'  and  `buff'  in  the
            MEM-line) is not implied!
            If  the  number  of pages swapped out (`swout' in the PAG-line) is larger than 10 per
            second, the memory resource is considered `critical'.  A value  of  at  least  1  per
            second is considered `almost critical'.
            If  the  committed  virtual memory exceeds the limit (`vmcom' and `vmlim' in the SWP-
            line), the SWP-line is colored due to overcommitting the system.

        Swap
            An occupation percentage of 80% is considered `critical' because swap space might  be
            completely exhausted in the near future; it is not critical from a performance point-
            of-view.

       These default values can be modified in the configuration file (see separate  man-page  of
       atoprc).

       When  a  resource  exceeded  its critical occupation percentage, the entire screen line is
       colored red.
       When a resource exceeded (default) 80%  of  its  critical  percentage  (so  it  is  almost
       critical),  the entire screen line is colored cyan. This `almost critical percentage' (one
       value for all resources) can be modified in the configuration file (see separate  man-page
       of atoprc).

       With the key 'x' (or flag -x), line coloring can be suppressed.

INTERACTIVE COMMANDS

       When  running  atop  interactively (no output redirection), keys can be pressed to control
       the output. In general, lower case keys can be used to  show  other  information  for  the
       active processes and upper case keys can be used to influence the sort order of the active
       process list.

       g    Show generic output (default).

            Per process the following fields are shown in case of a window-width of 80 positions:
            process-id,  cpu  consumption  during the last interval in system- and user mode, the
            virtual and resident memory growth of the process.
            The subsequent columns depend on the used kernel: When the  kernel  patch  `cnt'  has
            been  installed,  the  number of read- and write transfers on disk, and the number of
            received and transmitted network packets are shown for each process.  When the kernel
            patch  is not installed and the kernel supports "storage accounting" (>= 2.6.20), the
            data transfer for read/write on disk, the status and exit code  are  shown  for  each
            process.   When  the  kernel  patch  is not installed and the kernel does not support
            "storage accounting", the username, number of threads in the thread group, the status
            and exit code are shown.
            The  last  columns  contain  the  state,  the  occupation  percentage for the choosen
            resource (default: cpu) and the process name.

            When more than 80 positions are available, other information is added.

       m    Show memory related output.

            Per process the following fields are shown in case of a window-width of 80 positions:
            process-id, minor and major memory faults, size of virtual shared text, total virtual
            process size, total resident process size, virtual and resident  growth  during  last
            interval, memory occupation percentage and process name.

            When more than 80 positions are available, other information is added.

       d    Show disk-related output.

            When  "storage  accounting"  is active in the kernel, the following fields are shown:
            process-id, amount of data read from disk, amount of data written to disk, amount  of
            data  that  was  written  but  has  been  withdrawn  again  (WCANCL), disk occupation
            percentage and process name.

            When the kernel patch `cnt' is installed in the  kernel,  the  following  fields  are
            shown:  process-id,  number  of  physical  disk reads, average size per read (bytes),
            total size for read transfers, physical disk writes, average size per write  (bytes),
            total size for write transfers, disk occupation percentage and process name.

       n    Show network related output.

            Per process the following fields are shown in case of a window-width of 80 positions:
            process-id, number of received TCP packets with  the  average  size  per  packet  (in
            bytes),  number  of  sent  TCP  packets  with the average size per packet (in bytes),
            number of received UDP packets with the average size per packet (in bytes), number of
            sent  UDP  packets with the average size per packet (in bytes), and received and sent
            raw packets (e.g. ICMP) in one column, the network occupation percentage and  process
            name.
            This information can only be shown when kernel patch `cnt' is installed.

            When more than 80 positions are available, other information is added.

       s    Show scheduling characteristics.

            Per process the following fields are shown in case of a window-width of 80 positions:
            process-id, number of threads in state 'running' (R),  number  of  threads  in  state
            'interruptible  sleeping'  (S), number of threads in state 'uninterruptible sleeping'
            (D), scheduling policy (normal timesharing,  realtime  round-robin,  realtime  fifo),
            nice value, priority, realtime priority, current processor, status, exit code, state,
            the occupation percentage for the choosen resource and the process name.

            When more than 80 positions are available, other information is added.

       v    Show various process characteristics.

            Per process the following fields are shown in case of a window-width of 80 positions:
            process-id,  user  name and group, start date and time, status (e.g. exit code if the
            process has finished), state, the occupation percentage for the choosen resource  and
            the process name.

            When more than 80 positions are available, other information is added.

       c    Show the command line of the process.

            Per process the following fields are shown: process-id, the occupation percentage for
            the choosen resource and the command line including arguments.

       o    Show the user-defined line of the process.

            In the  configuration  file  the  keyword  ownprocline  can  be  specified  with  the
            description of a user-defined output-line.
            Refer to the man-page of atoprc for a detailed description.

       u    Show the process activity accumulated per user.

            Per  user  the  following  fields are shown: number of processes active or terminated
            during last interval (or in total if combined  with  command  `a'),  accumulated  cpu
            consumption  during  last  interval in system- and user mode, the current virtual and
            resident memory space consumed by active processes (or all processes of the  user  if
            combined with command `a').
            When the kernel patch `cnt' has been installed or "storage accounting" is active, the
            accumulated read- and write throughput on disk is shown.  When the kernel patch `cnt'
            has been installed, the number of received and sent network packets are shown.
            The  last  columns  contain  the  accumulated  occupation  percentage for the choosen
            resource (default: cpu) and the user name.

       p    Show the process activity accumulated per program (i.e. process name).

            Per program the following fields are shown: number of processes active or  terminated
            during  last  interval  (or  in  total if combined with command `a'), accumulated cpu
            consumption during last interval in system- and user mode, the  current  virtual  and
            resident  memory  space consumed by active processes (or all processes of the user if
            combined with command `a').
            When the kernel patch `cnt' has been installed or "storage accounting" is active, the
            accumulated read- and write throughput on disk is shown.  When the kernel patch `cnt'
            has been installed, the number of received and sent network packets are shown.
            The last columns contain  the  accumulated  occupation  percentage  for  the  choosen
            resource (default: cpu) and the program name.

       C    Sort  the  current  list in the order of cpu consumption (default).  The one-but-last
            column changes to ``CPU''.

       M    Sort the current list in the order of resident memory consumption.  The  one-but-last
            column changes to ``MEM''.

       D    Sort  the current list in the order of disk accesses issued.  The one-but-last column
            changes to ``DSK''.

       N    Sort the current list in the order of network packets received/transmitted.  The one-
            but-last column changes to ``NET''.

       A    Sort  the  current  list  automatically in the order of the most busy system resource
            during this interval.  The  one-but-last  column  shows  either  ``ACPU'',  ``AMEM'',
            ``ADSK'' or ``ANET'' (the preceding 'A' indicates automatic sorting-order).  The most
            busy resource is determined by comparing the weighted busy-percentages of the  system
            resources, as described earlier in the section COLORS.
            This option remains valid until another sorting-order is explicitly selected again.
            A sorting-order for disk is only possible when the kernel patch `cnt' is installed or
            "storage accounting" is active.  A sorting-order for network is  only  possible  when
            the kernel patch `cnt' is installed.

       Miscellaneous interactive commands:

       ?    Request for help information (also the key 'h' can be pressed).

       V    Request for version information (version number and date).

       x    Suppress colors to highlight critical resources (toggle).
            Whether this key is active or not can be seen in the header line.

       z    The pause key can be used to freeze the current situation in order to investigate the
            output on the screen. While atop is paused, the keys described above can  be  pressed
            to  show  other  information about the current list of processes.  Whenever the pause
            key is pressed again, atop will continue with a next sample.

       i    Modify the interval timer (default: 10  seconds).  If  an  interval  timer  of  0  is
            entered,  the  interval  timer is switched off. In that case a new sample can only be
            triggered manually by pressing the key 't'.

       t    Trigger a new sample manually. This key can be pressed if the current  sample  should
            be  finished  before  the  timer has exceeded, or if no timer is set at all (interval
            timer defined as 0). In the latter case atop can be used as a  stopwatch  to  measure
            the  load  being  caused  by a particular application transaction, without knowing on
            beforehand how many seconds this transaction will last.

            When viewing the contents of a raw file, this key can be used to show the next sample
            from the file.

       T    When  viewing  the  contents of a raw file, this key can be used to show the previous
            sample from the file.

       b    When viewing the contents of a raw file, this key can be used to branch to a  certain
            timestamp within the file (either forward or backward).

       r    Reset all counters to zero to see the system and process activity since boot again.

            When  viewing  the  contents  of  a  raw  file, this key can be used to rewind to the
            beginning of the file again.

       U    Specify a search string for specific user names as a regular  expression.   From  now
            on,  only  (active)  processes  will  be  shown from a user which matches the regular
            expression.  The system statistics are  still  system  wide.   If  the  Enter-key  is
            pressed without specifying a name, active processes of all users will be shown again.
            Whether this key is active or not can be seen in the header line.

       P    Specify a search string for specific process names as a regular expression.  From now
            on, only processes will be shown with a name which matches  the  regular  expression.
            The  system  statistics  are  still system wide.  If the Enter-key is pressed without
            specifying a name, all active processes will be shown again.
            Whether this key is active or not can be seen in the header line.

       a    The `all/active' key can be used to  toggle  between  only  showing/accumulating  the
            processes that were active during the last interval (default) or showing/accumulating
            all processes.
            Whether this key is active or not can be seen in the header line.

       f    Fixate the number of lines for system resources (toggle).  By default only the  lines
            are  shown  about system resources (cpu, paging, disk, network) that really have been
            active during the last interval.  With this key you can force atop to show  lines  of
            inactive resources as well.
            Whether this key is active or not can be seen in the header line.

       1    Show  relevant  counters as an average per second (in the format `..../s') instead of
            as a total during the interval (toggle).
            Whether this key is active or not can be seen in the header line.

       l    Limit the number of system level lines for the counters per-cpu, the active disks and
            the  network  interfaces.  By default lines are shown of all cpu's, disks and network
            interfaces which have been active during the last interval.  Limiting these lines can
            be  useful on systems with huge number cpu's, disks or interfaces in order to be able
            to run atop on a screen/window with e.g. only 24 lines.
            For  all  mentioned  resources  the  maximum  number  of  lines  can   be   specified
            interactively.  When  using the flag -l the maximum number of per-cpu lines is set to
            0, the maximum number of disk lines to 5 and the maximum number of interface lines to
            3.  These values can be modified again in interactive mode.

       k    Send a signal to an active process (a.k.a. kill a process).

       q    Quit the program.

       ^F   Show the next page of the process list (forward).

       ^B   Show the previous page of the process list (backward).

       ^L   Redraw the screen.

RAW DATA STORAGE

       In  order  to  store  system- and process level statistics for long-term analysis (e.g. to
       check the system load and the active processes running yesterday  between  3:00  and  4:00
       PM),  atop  can store the system- and process level statistics in compressed binary format
       in a raw file with the flag -w followed by the filename.  If this file already exists  and
       is  recognized as a raw data file, atop will append new samples to the file (starting with
       a sample which reflects the activity since boot); if the file does not exist, it  will  be
       created.
       By default only processes which have been active during the interval are stored in the raw
       file. When the flag -a is specified, all processes will be stored.
       The interval (default: 10 seconds) and number of samples (default: infinite) can be passed
       as  last  arguments. Instead of the number of samples, the flag -S can be used to indicate
       that atop should finish anyhow before midnight.

       A raw file can be read and visualized again with the flag -r followed by the filename.  If
       no  filename  is specified, the file /var/log/atop.log is opened for input.  If a filename
       is specified in the format yyyymmdd (where yyyymmdd  are  digits  representing  any  valid
       date),  the  file  /var/log/atop/atop_yyyymmdd is opened.  If a filename with the symbolic
       name y is specified, yesterday's daily logfile is opened (this can be repeated  so  'yyyy'
       indicates the logfile of four days ago).
       The  samples  from  the  file can be viewed interactively by using the key 't' to show the
       next sample, the key 'T' to show  the  previous  sample,  the  key  'b'  to  branch  to  a
       particular time or the key 'r' to rewind to the begin of the file.
       When  output  is redirected to a file or pipe, atop prints all samples in plain ASCII. The
       default line length is 80 characters in that  case;  with  the  flag  -L  followed  by  an
       alternate line length, more (or less) columns will be shown.
       With the flag -b (begin time) and/or -e (end time) followed by a time argument of the form
       HH:MM, a certain time period within the raw file can be selected.

       The Debian package automatically starts up atop via init, rotation of the logfiles is done
       with  logrotate.  Therefore,  the  suggested  layout  with  cron  scripts  in /etc/atop as
       described in the upstream package is not necessary for Debian.

OUTPUT DESCRIPTION

       The first sample shows the system level activity since  boot  (the  elapsed  time  in  the
       header shows the time since boot).  Note that particular counters could have reached their
       maximum value (several times) and started by zero again, so do not rely on these figures.

       For every sample atop first shows the  lines  related  to  system  level  activity.  If  a
       particular  system resource has not been used during the interval, the entire line related
       to this resource is suppressed. So the number of system level  lines  may  vary  for  each
       sample.
       After  that  a list is shown of processes which have been active during the last interval.
       This list is by default sorted on cpu consumption, but this order can be  changed  by  the
       keys which are previously described.

       If  values have to be shown by atop which do not fit in the column width, another notation
       is used. If e.g. a cpu-consumption of 233216 milliseconds should  be  shown  in  a  column
       width  of  4  positions,  it  is  shown as `233s' (in seconds).  For large memory figures,
       another unit is chosen if the value does not fit (Mb instead of Kb,  Gb  instead  of  Mb).
       For  other  values, a kind of exponent notation is used (value 123456789 shown in a column
       of 5 positions gives 123e6).

OUTPUT DESCRIPTION - SYSTEM LEVEL

       The system level information consists of the following output lines:

       PRC  Process level totals.
            This line contains the total cpu time consumed in system mode  (`sys')  and  in  user
            mode  (`user'),  the  total number of processes present at this moment (`#proc'), the
            total number of  threads  present  at  this  moment  in  state  `running'  (`#trun'),
            `sleeping  interruptible'  (`#tslpi')  and `sleeping uninterruptible' (`#tslpu'), the
            number of zombie processes (`#zombie'), the number of clone system calls  (`clones'),
            and  the number of processes that ended during the interval (`#exit', which shows `?'
            if process accounting is not used).
            If the screen-width does not allow all of these counters, only a relevant  subset  is
            shown.

       CPU  CPU utilization.
            At least one line is shown for the total occupation of all CPU's together.
            In case of a multi-processor system, an additional line is shown for every individual
            processor (with `cpu' in lower case), sorted on activity. Inactive cpu's will not  be
            shown by default.  The lines showing the per-cpu occupation contain the cpu number in
            the last field.

            Every line contains the percentage of cpu time spent in kernel  mode  by  all  active
            processes  (`sys'), the percentage of cpu time consumed in user mode (`user') for all
            active processes (including processes running with a nice value  larger  than  zero),
            the  percentage  of  cpu time spent for interrupt handling (`irq') including softirq,
            the percentage of unused cpu time  while  no  processes  were  waiting  for  disk-I/O
            (`idle'),  and  the  percentage  of  unused  cpu  time while at least one process was
            waiting for disk-I/O (`wait').
            In case of per-cpu occupation, the last column shows the  cpu  number  and  the  wait
            percentage  (`w')  for  that cpu.  The number of lines showing the per-cpu occupation
            can be limited.

            For  virtual  machines  the  steal-percentage  is  shown  (`steal'),  reflecting  the
            percentage of cpu time stolen by other virtual machines running on the same hardware.
            For  physical  machines hosting one or more virtual machines, the guest-percentage is
            shown (`guest'), reflecting the percentage of cpu time used by the virtual machines.

            In case of frequency-scaling, all previously mentioned CPU-percentages  are  relative
            to  the  used  scaling of the CPU during the interval.  If e.g. a CPU has been active
            for 50% in user mode during the interval while the frequency-scaling of that was 40%,
            then only 20% of the full capacity of the CPU has been used in user mode.
            In  case  that  the kernel module `cpufreq_stats' is active (after issueing `modprobe
            cpufreq_stats'), the average frequency (`avgf') and the  average  scaling  percentage
            (`avgscal')  is  shown.  Otherwise  the  current  frequency  (`curf') and the current
            scaling percentage (`curscal') is shown at the moment that the sample is taken.

            If the screen-width does not allow all of these counters, only a relevant  subset  is
            shown.

       CPL  CPU load information.
            This line contains the load average figures reflecting the number of threads that are
            available to run on a CPU (i.e. part of the runqueue) or that are  waiting  for  disk
            I/O. These figures are averaged over 1 (`avg1'), 5 (`avg5') and 15 (`avg15') minutes.
            Furthermore the number of context switches (`csw'), the number of serviced interrupts
            (`intr') and the number of available cpu's are shown.

            If the screen-width does not allow all of these counters, only a relevant  subset  is
            shown.

       MEM  Memory occupation.
            This  line contains the total amount of physical memory (`tot'), the amount of memory
            which is currently free  (`free'),  the  amount  of  memory  in  use  as  page  cache
            (`cache'),  the amount of memory within the page cache that has to be flushed to disk
            (`dirty'), the amount of memory used for filesystem meta data (`buff') and the amount
            of memory being used for kernel malloc's (`slab' - always 0 for kernel 2.4).

            If  the  screen-width does not allow all of these counters, only a relevant subset is
            shown.

       SWP  Swap occupation and overcommit info.
            This line contains the total amount of swap space on disk (`tot') and the  amount  of
            free swap space (`free').
            Furthermore the committed virtual memory space (`vmcom') and the maximum limit of the
            committed space (`vmlim', which is by default swap size plus 50% of memory  size)  is
            shown.   The  committed  space  is  the reserved virtual space for all allocations of
            private memory space for processes. The kernel only verifies  whether  the  committed
            space   exceeds   the   limit   if   strict   overcommit   handling   is   configured
            (vm.overcommit_memory is 2).

       PAG  Paging frequency.
            This line contains the number of scanned pages (`scan') due to  the  fact  that  free
            memory  drops below a particular threshold and the number times that the kernel tries
            to reclaim pages due to an urgent need (`stall').
            Also the number of memory pages the system read from  swap  space  (`swin')  and  the
            number of memory pages the system wrote to swap space (`swout') are shown.

       LVM/MDD/DSK
            Logical volume/multiple device/disk utilization.
            Per  active  unit one line is produced, sorted on unit activity.  Such line shows the
            name (e.g. VolGroup00-lvtmp for a logical volume or sda for a hard  disk),  the  busy
            percentage  i.e.  the  portion  of  time  that  the  unit  was busy handling requests
            (`busy'), the number of read requests issued (`read'), the number of  write  requests
            issued (`write'), the number of KiBytes per read (`KiB/r'), the number of KiBytes per
            write (`KiB/w'), the number of MiBytes per second throughput for reads (`MBr/s'), the
            number of MiBytes per second throughput for writes (`MBw/s'), the average queue depth
            (`avq') and the average number of milliseconds needed by a request (`avio') for seek,
            latency and data transfer.
            If  the  screen-width does not allow all of these counters, only a relevant subset is
            shown.

            The number of lines showing the units can be limited per class (LVM, MDD or DSK) with
            the 'l' key or statically (see separate man-page of atoprc).  By specifying the value
            0 for a particular class, no lines will be shown any more for that class.

       NET  Network utilization (TCP/IP).
            One line is shown for activity of the transport layer (TCP and UDP), one line for the
            IP layer and one line per active interface.
            For  the  transport  layer,  counters are shown concerning the number of received TCP
            segments including those received in error (`tcpi'), the number  of  transmitted  TCP
            segments excluding those containing only retransmitted octets (`tcpo'), the number of
            UDP datagrams received (`udpi'), the number of UDP  datagrams  transmitted  (`udpo'),
            the  number of active TCP opens (`tcpao'), the number of passive TCP opens (`tcppo'),
            the number of TCP output retransmissions (`tcprs'), the number of  TCP  input  errors
            (`tcpie'),  the  number  of  TCP  output  resets  (`tcpie'), the number of TCP output
            retransmissions (`tcpor'), the number of UDP no ports (`udpnp'), and  the  number  of
            UDP input errors (`tcpie').
            If  the  screen-width does not allow all of these counters, only a relevant subset is
            shown.
            These counters are related to IPv4 and IPv6 combined.

            For the IP layer, counters are shown concerning the number of IP  datagrams  received
            from  interfaces,  including  those  received  in  error  (`ipi'),  the  number of IP
            datagrams that local higher-layer protocols offered  for  transmission  (`ipo'),  the
            number  of  received IP datagrams which were forwarded to other interfaces (`ipfrw'),
            the number of IP datagrams which  were  delivered  to  local  higher-layer  protocols
            (`deliv'),  the  number  of  received  ICMP  datagrams  (`icmpi'),  and the number of
            transmitted ICMP datagrams (`icmpo').
            If the screen-width does not allow all of these counters, only a relevant  subset  is
            shown.
            These counters are related to IPv4 and IPv6 combined.

            For  every  active  network  interface  one  line  is  shown, sorted on the interface
            activity.  Such line shows the name of the interface and its busy percentage  in  the
            first  column.   The  busy  percentage for half duplex is determined by comparing the
            interface speed with the number of bits transmitted and received per second; for full
            duplex  the interface speed is compared with the highest of either the transmitted or
            the received bits.  When the interface speed can not  be  determined  (e.g.  for  the
            loopback interface), `---' is shown instead of the percentage.
            Furthermore  the  number  of  received  packets  (`pcki'),  the number of transmitted
            packets (`pcko'), the effective amount  of  bits  received  per  second  (`si'),  the
            effective  amount  of  bits  transmitted  per second (`so'), the number of collisions
            (`coll'), the number of received multicast packets (`mlti'),  the  number  of  errors
            while  receiving  a packet (`erri'), the number of errors while transmitting a packet
            (`erro'), the number  of  received  packets  dropped  (`drpi'),  and  the  number  of
            transmitted packets dropped (`drpo').
            If  the  screen-width does not allow all of these counters, only a relevant subset is
            shown.
            The number of lines showing the network interfaces can be limited.

OUTPUT DESCRIPTION - PROCESS LEVEL

       Following the system level information, the processes are shown from  which  the  resource
       utilization has changed during the last interval. These processes might have used cpu time
       or issued disk- or network requests. However a process is also shown if  part  of  it  has
       been paged out due to lack of memory (while the process itself was in sleep state).

       Per  process  the  following fields may be shown (in alphabetical order), depending on the
       current output mode as described in the section INTERACTIVE COMMANDS and depending on  the
       current width of your window:

       AVGRSZ   The average size of one read-action on disk.

       AVGWSZ   The average size of one write-action on disk.

       CMD      The  name  of  the  process.   This name can be surrounded by "less/greater than"
                signs (`<name>') which means that  the  process  has  finished  during  the  last
                interval.
                Behind the abbreviation `CMD' in the header line, the current page number and the
                total number of pages of the process list are shown.

       COMMAND-LINE
                The full command line of the process (including arguments), which is  limited  to
                the   length  of  the  screen  line.   Th  command  line  can  be  surrounded  by
                "less/greater than" signs (`<line>') which means that the  process  has  finished
                during the last interval.
                Behind  the  verb  `COMMAND-LINE' in the header line, the current page number and
                the total number of pages of the process list are shown.

       CPU      The occupation percentage of this process related to the available  capacity  for
                this resource on system level.

       CPUNR    The identification of the CPU the main thread of the process is running on or has
                recently been running on.

       DSK      The occupation percentage of this process related  to  the  total  load  that  is
                produced  by  all processes (i.e. total disk accesses by all processes during the
                last interval).
                This information is shown when per process "storage accounting" is active in  the
                kernel or when the kernel patch `cnt' has been installed.

       EGID     Effective group-id under which this process executes.

       ENDATE   Date  that  the  process has been finished. If the process is still running, this
                field shows `active'.

       ENTIME   Time that the process has been finished. If the process is  still  running,  this
                field shows `active'.

       EUID     Effective user-id under which this process executes.

       EXC      The  exit  code  of a terminated process (second position of column `ST' is E) or
                the fatal signal number (second position of column `ST' is S or C).

       FSGID    Filesystem group-id under which this process executes.

       FSUID    Filesystem user-id under which this process executes.

       MAJFLT   The number of page faults issued  by  this  process  that  have  been  solved  by
                creating/loading the requested memory page.

       MEM      The  occupation  percentage of this process related to the available capacity for
                this resource on system level.

       MINFLT   The number of page faults issued  by  this  process  that  have  been  solved  by
                reclaiming the requested memory page from the free list of pages.

       NET      The  occupation  percentage  of  this  process  related to the total load that is
                produced by all processes (i.e. network  packets  transferred  by  all  processes
                during the last interval).
                This information can only be shown when kernel patch `cnt' is installed.

       NICE     The  more  or  less static priority that can be given to a proces on a scale from
                -20 (high priority) to +19 (low priority).

       NPROCS   The number of active and  terminated  processes  accumulated  for  this  user  or
                program.

       PID      Process-id.  If a process has been started and finished during the last interval,
                a `?' is shown because the  process-id  is  not  part  of  the  standard  process
                accounting record.  However when the kernel patch `acct' is installed, this value
                will be shown properly.

       POLI     The policies 'norm' (normal, which is SCHED_OTHER),  'btch'  (batch)  and  'idle'
                refer to timesharing processes.  The policies 'fifo' (SCHED_FIFO) and 'rr' (round
                robin, which is SCHED_RR) refer to realtime processes.

       PPID     Parent process-id.  If a process has been started and finished  during  the  last
                interval,  value  0  is  shown  because  the parent process-id is not part of the
                standard process accounting record.  However when  the  kernel  patch  `acct'  is
                installed, this value will be shown properly.

       PRI      The  process' priority ranges from 0 (highest priority) to 139 (lowest priority).
                Priority 0 to 99 are used for realtime processes (fixed priority  independent  of
                their  behavior)  and  priority  100  to  139 for timesharing processes (variable
                priority depending on their recent CPU consumption and the nice value).

       RAWRCV   The number of raw datagrams received by this process.  This information can  only
                be shown when kernel patch `cnt' is installed.
                If  a  process  has  finished  during  the last interval, no value is shown since
                network counters are not registered in the standard  process  accounting  record.
                However when the kernel patch `acct' is installed, this value will be shown.

       RAWSND   The  number  of raw datagrams sent by this process.  This information can only be
                shown when kernel patch `cnt' is installed.
                If a process has finished during the last  interval,  no  value  is  shown  since
                network  counters  are  not registered in the standard process accounting record.
                However when the kernel patch `acct' is installed, this value will be shown.

       RDDSK    When the kernel maintains standard io statistics (>= 2.6.20):
                The read data transfer issued physically on disk (so reading from the disk  cache
                is not accounted for).

                When the kernel patch `cnt' is installed:
                The  number  of read accesses issued physically on disk (so reading from the disk
                cache is not accounted for).

       RGID     The real group-id under which the process executes.

       RGROW    The amount of resident  memory  that  the  process  has  grown  during  the  last
                interval. A resident growth can be caused by touching memory pages which were not
                physically created/loaded before (load-on-demand).  Note that a  resident  growth
                can  also  be  negative e.g. when part of the process is paged out due to lack of
                memory or when the process frees dynamically allocated  memory.   For  a  process
                which  started  during  the last interval, the resident growth reflects the total
                resident size of the process at that moment.
                If a process has finished during the last  interval,  no  value  is  shown  since
                resident memory occupation is not part of the standard process accounting record.
                However when the kernel patch `acct' is installed, this value will be shown.

       RNET     The number of TCP- and UDP packets received by this  process.   This  information
                can only be shown when kernel patch `cnt' is installed.
                If  a  process  has  finished  during  the last interval, no value is shown since
                network counters are not part of the standard process accounting record.  However
                when the kernel patch `acct' is installed, this value will be shown.

       RSIZE    The total resident memory usage consumed by this process (or user).
                If  a  process  has  finished  during  the last interval, no value is shown since
                resident memory occupation is not part of the standard process accounting record.
                However when the kernel patch `acct' is installed, this value will be shown.

       RTPR     Realtime priority according the POSIX standard.  Value can be 0 for a timesharing
                process (policy 'norm', 'btch' or 'idle') or  ranges  from  1  (lowest)  till  99
                (highest) for a realtime process (policy 'rr' or 'fifo').

       RUID     The real user-id under which the process executes.

       S        The  current  state of the main thread of the process: `R' for running (currently
                processing or in the runqueue), `S' for sleeping interruptible (wait for an event
                to  occur),  `D'  for  sleeping  non-interruptible, `Z' for zombie (waiting to be
                synchronized with its parent process), `T' for stopped (suspended or traced), `W'
                for  swapping,  and  `E' (exit) for processes which have finished during the last
                interval.

       SGID     The saved group-id of the process.

       SNET     The number of TCP- and UDP packets transmitted by this process.  This information
                can only be shown when kernel patch `cnt' is installed.
                If  a  process  has  finished  during  the last interval, no value is shown since
                network-counters are not part of the standard process accounting record.  However
                when the kernel patch `acct' is installed, this value will be shown.

       ST       The status of a process.
                The  first  position  indicates  if  the process has been started during the last
                interval (the value N means 'new process').

                The second position indicates if the process has been finished  during  the  last
                interval.
                The  value  E  means  'exit'  on  the  process'  own initiative; the exit code is
                displayed in the column `EXC'.
                The value S means that the process has been terminated unvoluntarily by a signal;
                the signal number is displayed in the in the column `EXC'.
                The value C means that the process has been terminated unvoluntarily by a signal,
                producing a core dump in its current directory; the signal number is displayed in
                the column `EXC'.

       STDATE   The start date of the process.

       STTIME   The start time of the process.

       SUID     The saved user-id of the process.

       SYSCPU   CPU time consumption of this process in system mode (kernel mode), usually due to
                system call handling.

       TCPRASZ  The average size of a received TCP  buffer  in  bytes  (by  the  process).   This
                information  can  only  be  shown when kernel patch `cnt' is installed.  When the
                kernel patch `acct' is installed as well, this value will also be  shown  when  a
                process has finished during the last interval.

       TCPRCV   The  number  of  receive  requests  issued by this process for TCP sockets.  This
                information can only be shown when kernel patch `cnt'  is  installed.   When  the
                kernel  patch  `acct'  is installed as well, this value will also be shown when a
                process has finished during the last interval.

       TCPSASZ  The average size of a transmitted TCP buffer in bytes  (by  the  process).   This
                information  can  only  be  shown when kernel patch `cnt' is installed.  When the
                kernel patch `acct' is installed as well, this value will also be  shown  when  a
                process has finished during the last interval.

       TCPSND   The  number  of  send  requests  issued  by this process for TCP sockets, and the
                average size per transfer in bytes.  This information  can  only  be  shown  when
                kernel  patch  `cnt'  is installed.  When the kernel patch `acct' is installed as
                well, this value will also be shown when a process has finished during  the  last
                interval.

       THR      Total  number  of threads within this process.  All related threads are contained
                in a thread group, represented by atop as one line.

                On Linux 2.4 systems it is hardly  possible  to  determine  which  threads  (i.e.
                processes)  are related to the same thread group.  Every thread is represented by
                atop as a separate line.

       TOTRSZ   The total amount of data physically read from disk.  This information can only be
                shown when kernel patch `cnt' is installed.

       TOTWSZ   The  total  amount of data physically written to disk.  This information can only
                be shown when kernel patch `cnt' is installed.

       TRUN     Number of threads within this process that are in the state 'running' (R).

       TSLPI    Number of threads within this  process  that  are  in  the  state  'interruptible
                sleeping' (S).

       TSLPU    Number  of  threads  within  this  process that are in the state 'uninterruptible
                sleeping' (D).

       UDPRASZ  The average size of a received UDP packet in bytes.  This information can only be
                shown  when  kernel  patch  `cnt'  is installed.  When the kernel patch `acct' is
                installed as well, this value will also be shown  when  a  process  has  finished
                during the last interval.

       UDPRCV   The  number  of  receive  requests  issued by this process for UDP sockets.  This
                information can only be shown when kernel patch `cnt'  is  installed.   When  the
                kernel  patch  `acct'  is installed as well, this value will also be shown when a
                process has finished during the last interval.

       UDPSASZ  The average size of a transmitted UDP packets in  bytes.   This  information  can
                only be shown when kernel patch `cnt' is installed.  When the kernel patch `acct'
                is installed as well, this value will also be shown when a process  has  finished
                during the last interval.

       UDPSND   The  number  of  send  requests  issued  by this process for TCP sockets, and the
                average size per transfer in bytes.  This information  can  only  be  shown  when
                kernel  patch  `cnt'  is installed.  When the kernel patch `acct' is installed as
                well, this value will also be shown when a process has finished during  the  last
                interval.

       USRCPU   CPU  time  consumption  of  this  process in user mode, due to processing the own
                program text.

       VGROW    The amount of virtual memory that the process has grown during the last interval.
                A  virtual growth can be caused by e.g. issueing a malloc() or attaching a shared
                memory segment. Note that a virtual growth can also be negative by e.g.  issueing
                a  free()  or  detaching  a  shared  memory segment.  For a process which started
                during the last interval, the virtual growth reflects the total virtual  size  of
                the process at that moment.
                If  a  process  has  finished  during  the last interval, no value is shown since
                virtual memory occupation is not part of the standard process accounting  record.
                However when the kernel patch `acct' is installed, this value will be shown.

       VSIZE    The total virtual memory usage consumed by this process (or user).
                If  a  process  has  finished  during  the last interval, no value is shown since
                virtual memory occupation is not part of the standard process accounting  record.
                However when the kernel patch `acct' is installed, this value will be shown.

       VSTEXT   The virtual memory size used by the shared text of this process.

       WRDSK    When the kernel maintains standard io statistics (>= 2.6.20):
                The  write  data transfer issued physically on disk (so writing to the disk cache
                is not accounted for).  This counter is maintained for  the  application  process
                that  writes  its  data  to  the  cache  (assuming  that  this data is physically
                transferred to disk later on). Notice that disk I/O needed for  swapping  is  not
                taken into account.

                When the kernel patch `cnt' is installed:
                The  number  of  write accesses issued physically on disk (so writing to the disk
                cache is not accounted for). Usually application processes  just  transfer  their
                data  to the cache, while the physical write accesses are done later on by kernel
                daemons like pdflush.  Note that the number read-  and  write  accesses  are  not
                separately maintained in the standard process accounting record.  This means that
                only one value is given for read's and write's in case  a  process  has  finished
                during  the  last  interval.   However when the kernel patch `acct' is installed,
                these values will be shown separately.

       WCANCL   When the kernel patch `cnt' is not installed, but the kernel  maintains  standard
                io statistics (>= 2.6.20):
                The  write data transfer previously accounted for this process or another process
                that has been cancelled.  Suppose that a process writes new data to  a  file  and
                that  data  is  removed again before the cache buffers have been flushed to disk.
                Then the original process shows the written data as WRDSK, while the process that
                removes/truncates the file shows the unflushed removed data as WCANCL.

PARSEABLE OUTPUT

       With  the  flag  -P  followed by a list of one or more labels (comma-separated), parseable
       output is produced for each sample.  The labels that can  be  specified  for  system-level
       statistics  correspond  to  the  labels (first verb of each line) that can be found in the
       interactive output: "CPU", "cpu" "CPL" "MEM", "SWP", "PAG", "LVM", "MDD", "DSK" and "NET".
       For process-level statistics special labels are introduced: "PRG" (general), "PRC"  (cpu),
       "PRM"  (memory),  "PRD"  (disk,  only  if  the  kernel-patch has been installed) and "PRN"
       (network, only if the kernel-patch has been installed).
       With the label "ALL", all system- and process-level statistics are shown.

       For every interval all requested lines  are  shown  whereafter  atop  shows  a  line  just
       containing  the  label  "SEP"  as  a  separator  before  the lines for the next sample are
       generated.
       When a sample contains the values since boot, atop shows a line just containing the  label
       "RESET" before the lines for this sample are generated.

       The  first  part of each output-line consists of the following six fields: label (the name
       of the label), host (the name of this machine), epoch (the time of this interval as number
       of  seconds since 1-1-1970), date (date of this interval in format YYYY/MM/DD), time (time
       of this interval in format HH:MM:SS), and interval (number of  seconds  elapsed  for  this
       interval).

       The subsequent fields of each output-line depend on the label:

       CPU      Subsequent  fields:  total  number  of  clock-ticks  per second for this machine,
                number of processors, consumption for all CPU's  in  system  mode  (clock-ticks),
                consumption  for  all CPU's in user mode (clock-ticks), consumption for all CPU's
                in user mode for niced processes (clock-ticks), consumption for all CPU's in idle
                mode  (clock-ticks),  consumption  for  all  CPU's  in  wait  mode (clock-ticks),
                consumption for all CPU's in irq mode (clock-ticks), consumption for all CPU's in
                softirq  mode  (clock-ticks),  consumption  for  all  CPU's in steal mode (clock-
                ticks), and consumption for all CPU's in guest mode (clock-ticks).

       cpu      Subsequent fields: total number of  clock-ticks  per  second  for  this  machine,
                processor-number,   consumption  for  this  CPU  in  system  mode  (clock-ticks),
                consumption for this CPU in user mode (clock-ticks), consumption for this CPU  in
                user  mode  for  niced  processes (clock-ticks), consumption for this CPU in idle
                mode  (clock-ticks),  consumption  for  this  CPU  in  wait  mode  (clock-ticks),
                consumption  for  this CPU in irq mode (clock-ticks), consumption for this CPU in
                softirq mode (clock-ticks), consumption for this CPU in steal mode (clock-ticks),
                and consumption for this CPU in guest mode (clock-ticks).

       CPL      Subsequent  fields:  number  of  processors,  load  average for last minute, load
                average for last five minutes, load average for last fifteen minutes,  number  of
                context-switches, and number of device interrupts.

       MEM      Subsequent fields: page size for this machine (in bytes), size of physical memory
                (pages), size of free memory (pages), size of page cache (pages), size of  buffer
                cache (pages), size of slab (pages), and number of dirty pages in cache.

       SWP      Subsequent  fields:  page size for this machine (in bytes), size of swap (pages),
                size of free swap (pages), 0 (future use), size of committed space  (pages),  and
                limit for committed space (pages).

       PAG      Subsequent  fields:  page size for this machine (in bytes), number of page scans,
                number of allocstalls, 0 (future use), number of swapins, and number of swapouts.

       LVM/MDD/DSK
                For every logical volume/multiple device/hard disk one line is shown.
                Subsequent fields: name, number of milliseconds spent for I/O,  number  of  reads
                issued,  number  of  sectors  transferred for reads, number of writes issued, and
                number of sectors transferred for write.

       NET      First one line is produced for the upper layers of the TCP/IP stack.
                Subsequent fields: the verb "upper", number of packets received by TCP, number of
                packets  transmitted by TCP, number of packets received by UDP, number of packets
                transmitted by  UDP,  number  of  packets  received  by  IP,  number  of  packets
                transmitted by IP, number of packets delivered to higher layers by IP, and number
                of packets forwarded by IP.

                Next one line is shown for every interface.
                Subsequent fields: name of the interface,  number  of  packets  received  by  the
                interface,  number  of  bytes  received  by  the  interface,  number  of  packets
                transmitted by the interface, number  of  bytes  transmitted  by  the  interface,
                interface speed, and duplex mode (0=half, 1=full).

       PRG      For every process one line is shown.
                Subsequent  fields: PID, name (between brackets), state, real uid, real gid, TGID
                (same as PID), total number of threads,  exit  code,  start  time  (epoch),  full
                command  line (between brackets), PPID, number of threads in state 'running' (R),
                number of threads in state 'interruptible sleeping' (S),  number  of  threads  in
                state  'uninterruptible  sleeping'  (D), effective uid, effective gid, saved uid,
                saved gid, filesystem uid, filesystem gid, and elapsed time (hertz).

       PRC      For every process one line is shown.
                Subsequent fields: PID, name (between brackets), state, total  number  of  clock-
                ticks  per  second  for  this machine, CPU-consumption in user mode (clockticks),
                CPU-consumption in system  mode  (clockticks),  nice  value,  priority,  realtime
                priority, scheduling policy, current CPU, and sleep average.

       PRM      For every process one line is shown.
                Subsequent  fields:  PID,  name  (between  brackets),  state,  page size for this
                machine (in bytes), virtual memory size (Kbytes), resident memory size  (Kbytes),
                shared text memory size (Kbytes), virtual memory growth (Kbytes), resident memory
                growth (Kbytes), number of minor page faults, and number of major page faults.

       PRD      For every process one line is shown.
                Subsequent fields: PID, name (between brackets),  state,  kernel-patch  installed
                ('y'  or 'n'), standard io statistics used ('y' or 'n'), number of reads on disk,
                cumulative number of sectors read, number of writes on disk, cumulative number of
                sectors written, and cancelled number of written sectors.
                If  the kernel patch is not installed and the standard I/O statistics (>= 2.6.20)
                are not used, the disk I/O counters per  process  are  not  relevant.   When  the
                kernel  patch  is installed, the counter 'cancelled number of written sectors' is
                not relevant.  When only the  standard  io  statistics  are  used,  the  counters
                'number of reads on disk' and 'number of writes on disk' are not relevant.

       PRN      For every process one line is shown.
                Subsequent  fields:  PID,  name (between brackets), state, kernel-patch installed
                ('y' or 'n'), number of TCP-packets transmitted, cumulative size  of  TCP-packets
                transmitted,  number  of  TCP-packets  received,  cumulative  size of TCP-packets
                received, number of  UDP-packets  transmitted,  cumulative  size  of  UDP-packets
                transmitted,  number  of  UDP-packets  received,  cumulative  size of UDP-packets
                transmitted, number of  raw  packets  transmitted,  and  number  of  raw  packets
                received.
                If  the  kernel  patch is not installed, the network I/O counters per process are
                not relevant.

EXAMPLES

       To monitor the current system load interactively with an interval of 5 seconds:

         atop 5

       To monitor the system load and write it to a file (in plain ASCII) with an interval of one
       minute during half an hour with active processes sorted on memory consumption:

         atop -M 60 30 > /log/atop.mem

       Store  information  about  the system- and process activity in binary compressed form to a
       file with an interval of ten minutes during an hour:

         atop -w /tmp/atop.raw 600 6

       View the contents of this file interactively:

         atop -r /tmp/atop.raw

       View the processor- and disk-utilization of this file in parseable format:

         atop -PCPU,DSK -r /tmp/atop.raw

       View the contents of today's standard logfile interactively:

         atop -r

       View the contents of the standard logfile of the day before yesterday interactively:

         atop -r yy

       View the contents of the standard logfile  of  2010,  January  7  from  02:00  PM  onwards
       interactively:

         atop -r 20100107 -b 14:00

FILES

       /tmp/atop.d/atop.acct
            File  in which the kernel writes the accounting records if the standard accounting to
            the file /var/log/pacct or /var/account/pacct is not used.

       /etc/atoprc
            Configuration file containing system-wide default values.  See related man-page.

       ~/.atoprc
            Configuration file containing personal default values.  See related man-page.

       /var/log/atop.log[.X]
            Raw file, where X is the age in days as added by logrotate(1).  This name is used  by
            atop as default name for the input file when using the -r flag.
            All  binary system- and process-level data in this file has been stored in compressed
            format.

SEE ALSO

       atopsar(1), atoprc(5), logrotate(8)
       http://www.atoptool.nl

AUTHOR

       Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
       JC van Winkel (jc@ATComputing.nl)