Provided by: atop_1.26-2_amd64 bug

NAME

       atopsar - AT Computing's System Activity Report (atop related)

SYNOPSIS

       atopsar [-flags...]  [-r file|date ] [-R cnt ] [-b hh:mm ] [-e hh:mm ]
       atopsar [-flags...]  interval [ samples ]

DESCRIPTION

       The program atopsar can be used to report statistics on system level.

       In  the first synopsis line (no sampling interval specified), atopsar extracts data from a
       raw logfile that has been recorded previously by the program atop (option -w of  the  atop
       program).
       You can specify the name of the logfile with the -r option of the atopsar program.  When a
       daily logfile of atop is used, named /var/log/atop/atop_YYYYMMDD (where YYYYMMDD  reflects
       the  date),  the  required  date  of the form YYYYMMDD can be specified with the -r option
       instead of the filename, or the symbolic name  'y'  can  be  used  for  yesterday's  daily
       logfile  (this  can be repeated so 'yyyy' indicates the logfile of four days ago).  If the
       -r option is not specified at all, today's daily logfile is used by default.
       The starting and ending times of the report can be defined using the  options  -b  and  -e
       followed by a time argument of the form hh:mm.

       In  the  second synopsis line, atopsar reads actual activity counters from the kernel with
       the specified interval (in seconds) and the  specified  number  of  samples  (optionally).
       When  atopsar is activated in this way it immediately sends the output for every requested
       report to standard output.  If only one type of report is requested, the header is printed
       once  and after every interval seconds the statistical counters are shown for that period.
       If several reports are  requested,  a  header  is  printed  per  sample  followed  by  the
       statistical counters for that period.

       Some generic flags can be specified to influence the behaviour of the atopsar program:

       -S   By  default  the timestamp at the beginning of a line is suppressed if more lines are
            shown for one interval. With this flag a timestamp is  given  for  every  output-line
            (easier for post-processing).

       -a   By default certain resources as disks and network interfaces are only shown when they
            were active during the interval.  With this flag all resources of a  given  type  are
            shown, even if they were inactive during the interval.

       -x   By  default  atopsar  only  uses colors if output is directed to a terminal (window).
            These colors might indicate that a critical occupation percentage  has  been  reached
            (red)  or has been almost reached (cyan) for a particular resource.  See the man-page
            of atop for a detailed description of this feature (section COLORS).
            With the flag -x the use of colors is suppressed unconditionally.

       -C   By default atopsar only uses colors if output is directed  to  a  terminal  (window).
            These  colors  might  indicate that a critical occupation percentage has been reached
            (red) or has been almost reached (cyan) for a particular resource.  See the  man-page
            of atop for a detailed description of this feature (section COLORS).
            With  the  flag  -C  colors  will always be used, even if output is not directed to a
            terminal.

       -M   Use markers at the end of a line to indicate that a  critical  occupation  percentage
            has been reached ('*') or has been almost reached ('+') for particular resources. The
            marker '*' is similar to the color red and the marker '+' to the color cyan. See  the
            man-page of atop for a detailed description of these colors (section COLORS).

       -H   Repeat  the  header  line within a report for every N detail lines. The value of N is
            determined dynamically in case of output to a tty/window (depending on the number  of
            lines); for output to a file or pipe this value is 23.

       -R   Summarize  cnt  samples into one sample. When the logfile contains e.g. samples of 10
            minutes, the use of the flag '-R 6' shows a report with one sample for every hour.

       Other flags are used to define which reports are required:

       -A   Show all possible reports.

       -c   Report about CPU utilization (in total and per cpu).

       -p   Report about processor-related matters, like load-averages and hardware interrupts.

       -P   Report about processes.

       -m   Current memory- and swap-occupation.

       -s   Report about paging- and swapping-activity, and overcommitment.

       -l   Report about utilization of logical volumes.

       -f   Report about utilization of multiple devices.

       -d   Report about utilization of disks.

       -i   Report about the network interfaces.

       -I   Report about errors for network-interfaces.

       -w   Report about IP version 4 network traffic.

       -W   Report about errors for IP version 4 traffic.

       -y   General report about ICMP version 4 layer activity.

       -Y   Per-type report about ICMP version 4 layer activity.

       -u   Report about UDP version 4 network traffic.

       -z   Report about IP version 6 network traffic.

       -Z   Report about errors for IP version 6 traffic.

       -k   General report about ICMP version 6 layer activity.

       -K   Per-type report about ICMP version 6 layer activity.

       -U   Report about UDP version 6 network traffic.

       -t   Report about TCP network traffic.

       -T   Report about errors for TCP-traffic.

       -O   Report about top-3 processes consuming most processor capacity.

       -G   Report about top-3 processes consuming most resident memory.

       -D   Report about top-3 processes issueing most disk transfers.

       -N   Report about top-3 processes issueing most IPv4/IPv6 socket transfers.

OUTPUT DESCRIPTION

       Depending on the requested report, a number of columns with output  values  are  produced.
       The values are mostly presented as a number of events per second.

       The output for the flag -c contains the following columns per cpu:

       usr%        Percentage  of  cpu-time  consumed  in user mode (program text) for all active
                   processes running with a nice value of zero (default) or a negative nice value
                   (which  means a higher priority than usual).  The cpu consumption in user mode
                   of processes with a nice value larger than zero (lower priority) is  indicated
                   in the nice%-column.

       nice%       Percentage  of  cpu  time  consumed  in  user mode (i.e. program text) for all
                   processes running witn a nice value larger than zero (which means with a lower
                   priority than average).

       sys%        Percentage  of  cpu  time consumed in system mode (kernel text) for all active
                   processes. A high percentage usually indicates a lot  of  system  calls  being
                   issued.

       irq%        Percentage of cpu time consumed for handling of device interrupts.

       softirq%    Percentage of cpu time consumed for soft interrupt handling.

       steal%      Percentage  of  cpu  time stolen by other virtual machines running on the same
                   hardware.

       guest%      Percentage of cpu time used by other virtual  machines  running  on  the  same
                   hardware.

       wait%       Percentage  of  unused  cpu  time while at least one of the processes in wait-
                   state awaits completion of disk I/O.

       idle%       Percentage of unused cpu time because all processes are in  a  wait-state  but
                   not waiting for disk-I/O.

       The output for the flag -p contains the following values:

       pswch/s     Number  of  process switches (also called context switches) per second on this
                   cpu. A process switch occurs at the moment that an active  thread  (i.e.   the
                   thread using a cpu) enters a wait state or has used its time slice completely;
                   another thread will then be chosen to use the cpu.

       devintr/s   Number of hardware interrupts handled per second on this cpu.

       clones/s    The number of new threads started per second.

       loadavg1    Load average reflecting the average number of threads in the  runqueue  or  in
                   non-interruptible wait state (usually waiting for disk or tape I/O) during the
                   last minute.

       loadavg5    Load average reflecting the average number of threads in the  runqueue  or  in
                   non-interruptible wait state (usually waiting for disk or tape I/O) during the
                   last 5 minutes.

       loadavg15   Load average reflecting the average number of threads in the  runqueue  or  in
                   non-interruptible wait state (usually waiting for disk or tape I/O) during the
                   last 15 minutes.

       The output for the flag -P contains information about the processes and threads:

       clones/s    The number of new threads started per second.

       pexit/s

       curproc     Total number of processes present in the system.

       curzomb     Number of zombie processes present in the system.

       thrrun      Total number of threads present in the system in state 'running'.

       thrslpi     Total number  of  threads  present  in  the  system  in  state  'interruptible
                   sleeping'.

       thrslpu     Total  number  of  threads  present  in  the  system in state 'uninterruptible
                   sleeping'.

       The output for the flag -m contains information about the memory- and swap-utilization:

       memtotal    Total usable main memory size.

       memfree     Available main memory size at this moment (snapshot).

       buffers     Main memory used at this moment to cache metadata-blocks (snapshot).

       cached      Main memory used at this moment to cache data-blocks (snapshot).

       dirty       Amount of memory in the page cache that still has to be  flushed  to  disk  at
                   this moment (snapshot).

       slabmem     Main memory used at this moment for dynamically allocated memory by the kernel
                   (snapshot).

       swptotal    Total swap space size at this moment (snapshot).

       swpfree     Available swap space at this moment (snapshot).

       The output for the flag -s contains information about the frequency of swapping:

       pagescan/s  Number of scanned pages per second due to the  fact  that  free  memory  drops
                   below a particular threshold.

       swapin/s    The number of memory-pages the system read from the swap-device per second.

       swapout/s   The number of memory-pages the system wrote to the swap-device per second.

       commitspc   The  committed  virtual  memory space i.e.  the reserved virtual space for all
                   allocations of private memory space for processes.

       commitlim   The maximum limit for the committed space, which is by default swap size  plus
                   50%  of  memory  size.   The  kernel only verifies whether the committed space
                   exceeds   the   limit   if   strict   overcommit   handling   is    configured
                   (vm.overcommit_memory is 2).

       The  output  for  the  flags  -l (LVM), -f (MD), and -d (hard disk) contains the following
       columns per active unit:

       disk        Name.

       busy        Busy-percentage of the unit (i.e. the portion of time that the device was busy
                   handling requests).

       read/s      Number of read-requests issued per second on this unit.

       KB/read     Average number of Kbytes transferred per read-request for this unit.

       writ/s      Number of write-requests issued per second on this unit.

       KB/writ     Average number of Kbytes transferred per write-request for this unit.

       avque       Average  number  of requests outstanding in the queue during the time that the
                   unit is busy.

       avserv      Average number of milliseconds needed by a request on this unit (seek, latency
                   and data-transfer).

       The output for the flag -i provides information about utilization of network interfaces:

       interf      Name of interface.

       busy        Busy  percentage for this interface.  If the linespeed of this interface could
                   not be determined (for virtual interfaces or in case that atop or atopsar  had
                   no root-privileges), a question mark is shown.

       ipack/s     Number of packets received from this interface per second.

       opack/s     Number of packets transmitted to this interface per second.

       iKbyte/s    Number of Kbytes received from this interface per second.

       oKbyte/s    Number of Kbytes transmitted via this interface per second.

       imbps/s     Effective number of megabits received per second.

       ombps/s     Effective number of megabits transmitted per second.

       maxmbps/s   Linespeed  as  number  of  megabits per second.  If the linespeed could not be
                   determined (for virtual interfaces or in case that  atop  or  atopsar  had  no
                   root-privileges), value 0 is shown.
                   The  linespeed  is  followed  by the indication 'f' (full duplex) or 'h' (half
                   duplex).

       The output for the flag -I provides information about the failures that were detected  for
       network interfaces:

       interf      Name of interface.

       ierr/s      Number of bad packets received from this interface per second.

       oerr/s      Number of times that packet transmission to this interface failed per second.

       coll/s      Number of collisions encountered per second while transmitting packets.

       idrop/s     Number  of  received packets dropped per second due to lack of buffer-space in
                   the local system.

       odrop/s     Number of transmitted packets dropped per second due to lack  of  buffer-space
                   in the local system.

       iframe/s    Number of frame alignment-errors encountered per second on received packets.

       ocarrier/s  Number of carrier-errors encountered per second on transmitted packets.

       The  output  for  the flag -w provides information about the utilization of the IPv4-layer
       (formal SNMP-names between brackets):

       inrecv/s    Number of IP datagrams received from interfaces per  second,  including  those
                   received in error (ipInReceives).

       outreq/s    Number  of  IP  datagrams  that local higher-layer protocols supplied to IP in
                   requests for transmission per second (ipOutRequests).

       indeliver/s Number of received IP datagrams that have been succesfully delivered to higher
                   protocol-layers per second (ipInDelivers).

       forward/s   Number of received IP datagrams per second for which this entity was not their
                   final IP destination, as a result of which an  attempt  was  made  to  forward
                   (ipForwDatagrams).

       reasmok/s   Number of IP datagrams succesfully reassembled per second (ipReasmOKs).

       fragcreat/s Number   of  IP  datagram  fragments  generated  per  second  at  this  entity
                   (ipFragCreates).

       The output for the flag -W provides information about the failures that were  detected  in
       the IPv4-layer (formal SNMP-names between brackets):

       in: dsc/s   Number of input IP datagrams per second for which no problems were encountered
                   to prevent their continued processing but that were discarded, e.g.  for  lack
                   of buffer space (ipInDiscards).

       in: hder/s  Number  of  input  IP  datagrams  per second discarded due to errors in the IP
                   header (ipInHdrErrors).

       in: ader/s  Number of input IP datagrams per second discarded because the  IP  address  in
                   the   destination   field  was  not  valid  to  be  received  by  this  entity
                   (ipInAddrErrors).

       in: unkp/s  Number of inbound packets per second that were discarded because of an unknown
                   or unsupported protocol (ipInUnknownProtos).

       in: ratim/s Number  of  timeout-situations  per second while other fragments were expected
                   for successful reassembly (ipReasmTimeout).

       in: rfail/s Number of  failures  detected  per  second  by  the  IP  reassembly  algorithm
                   (ipReasmFails).

       out: dsc/s  Number  of  output  IP  datagrams  per  second  for  which  no  problems  were
                   encountered to prevent their continued processing  but  that  were  discarded,
                   e.g. for lack of buffer space (ipOutDiscards).

       out: nrt/s  Number  of  IP  datagrams per second discarded because no route could be found
                   (ipOutNoRoutes).

       The output for the flag -y provides information  about  the  general  utilization  of  the
       ICMPv4-layer  and  some  information  per  type of ICMP-message (formal SNMP-names between
       brackets):

       intot/s     Number of ICMP  messages  (any  type)  received  per  second  at  this  entity
                   (icmpInMsgs).

       outtot/s    Number  of  ICMP  messages  (any type) transmitted per second from this entity
                   (icmpOutMsgs).

       inecho/s    Number of ICMP Echo (request) messages received per second (icmpInEchos).

       inerep/s    Number of ICMP Echo-Reply messages received per second (icmpInEchoReps).

       otecho/s    Number of ICMP Echo (request) messages transmitted per second (icmpOutEchos).

       oterep/s    Number of ICMP Echo-Reply messages transmitted per second (icmpOutEchoReps).

       The output for the flag -Y provides  information  about  other  types  of  ICMPv4-messages
       (formal SNMP-names between brackets):

       ierr/s      Number  of  ICMP  messages  received  per  second but determined to have ICMP-
                   specific errors (icmpInErrors).

       isq/s       Number of ICMP Source Quench messages received per second (icmpInSrcQuenchs).

       ird/s       Number of ICMP Redirect messages received per second (icmpInRedirects).

       idu/s       Number  of  ICMP  Destination  Unreachable  messages   received   per   second
                   (icmpInDestUnreachs).

       ite/s       Number of ICMP Time Exceeded messages received per second (icmpOutTimeExcds).

       oerr/s      Number  of  ICMP  messages transmitted per second but determined to have ICMP-
                   specific errors (icmpOutErrors).

       osq/s       Number   of   ICMP   Source   Quench   messages   transmitted    per    second
                   (icmpOutSrcQuenchs).

       ord/s       Number of ICMP Redirect messages transmitted per second (icmpOutRedirects).

       odu/s       Number  of  ICMP  Destination  Unreachable  messages  transmitted  per  second
                   (icmpOutDestUnreachs).

       ote/s       Number   of   ICMP   Time   Exceeded   messages   transmitted    per    second
                   (icmpOutTimeExcds).

       The  output  for the flag -u provides information about the utilization of the UDPv4-layer
       (formal SNMP-names between brackets):

       indgram/s   Number of UDP datagrams per second delivered to UDP users (udpInDatagrams).

       outdgram/s  Number  of  UDP  datagrams   transmitted   per   second   from   this   entity
                   (udpOutDatagrams).

       inerr/s     Number  of  received  UDP datagrams per second that could not be delivered for
                   reasons other than  the  lack  of  an  application  at  the  destination  port
                   (udpInErrors).

       noport/s    Number of received UDP datagrams per second for which there was no application
                   at the destination port (udpNoPorts).

       The output for the flag -z provides information about the utilization  of  the  IPv6-layer
       (formal SNMP-names between brackets):

       inrecv/s    Number  of input IPv6-datagrams received from interfaces per second, including
                   those received in error (ipv6IfStatsInReceives).

       outreq/s    Number of IPv6-datagrams per second that local higher-layer protocols supplied
                   to  IP  in  requests  for transmission (ipv6IfStatsOutRequests).  This counter
                   does not include any forwarded datagrams.

       inmc/s      Number of multicast  packets  per  second  that  have  been  received  by  the
                   interface (ipv6IfStatsInMcastPkts).

       outmc/s     Number  of  multicast  packets  per  second  that have been transmitted to the
                   interface (ipv6IfStatsOutMcastPkts).

       indeliv/s   Number of  IP  datagrams  succesfully  delivered  per  second  to  IPv6  user-
                   protocols, including ICMP (ipv6IfStatsInDelivers).

       reasmok/s   Number    of    IPv6    datagrams    succesfully    reassembled   per   second
                   (ipv6IfStatsReasmOKs).

       fragcre/s   Number of  IPv6  datagram  fragments  generated  per  second  at  this  entity
                   (ipv6IfStatsOutFragCreates).

       The  output  for the flag -Z provides information about the failures that were detected in
       the IPv6-layer (formal SNMP-names between brackets):

       in: dsc/s   Number of  input  IPv6  datagrams  per  second  for  which  no  problems  were
                   encountered  to  prevent  their  continued processing but that were discarded,
                   e.g. for lack of buffer space (ipv6IfStatsInDiscards).

       in: hder/s  Number of input datagrams per second discarded  due  to  errors  in  the  IPv6
                   header (ipv6IfStatsInHdrErrors).

       in: ader/s  Number of input datagrams per second discarded because the IPv6 address in the
                   destination  field  was  not   valid   to   be   received   by   this   entity
                   (ipv6IfStatsInAddrErrors).

       in: unkp/s  Number  of  locally-addressed datagrams per second that were discarded because
                   of an unknown or unsupported protocol (ipv6IfStatsInUnknownProtos).

       in: ratim/s Number of timeout-situations  per  second  while  other  IPv6  fragments  were
                   expected for successful reassembly (ipv6ReasmTimeout).

       in: rfail/s Number  of  failures  detected  per  second  by  the IPv6 reassembly-algorithm
                   (ipv6IfStatsReasmFails).

       out: dsc/s  Number of output  IPv6  datagrams  per  second  for  which  no  problems  were
                   encountered  to  prevent  their  continued processing but that were discarded,
                   e.g. for lack of buffer space (ipv6IfStatsOutDiscards).

       out: nrt/s  Number of IPv6 datagrams per second discarded because no route could be  found
                   (ipv6IfStatsInNoRoutes).

       The  output  for  the  flag  -k  provides information about the general utilization of the
       ICMPv6-layer and some information per type  of  ICMP-message  (formal  SNMP-names  between
       brackets):

       intot/s     Number  of  ICMPv6  messages  (any  type) received per second at the interface
                   (ipv6IfIcmpInMsgs).

       outtot/s    Number of ICMPv6 messages (any type) transmitted per second from  this  entity
                   (ipv6IfIcmpOutMsgs).

       inerr/s     Number  of  ICMPv6 messages received per second that had ICMP-specific errors,
                   such as bad ICMP checksums, bad length, etc (ipv6IfIcmpInErrors).

       innsol/s    Number   of   ICMP   Neighbor   Solicit   messages   received    per    second
                   (ipv6IfIcmpInNeighborSolicits).

       innadv/s    Number   of   ICMP   Neighbor   Advertisement  messages  received  per  second
                   (ipv6IfIcmpInNeighborAdvertisements).

       otnsol/s    Number  of   ICMP   Neighbor   Solicit   messages   transmitted   per   second
                   (ipv6IfIcmpOutNeighborSolicits).

       otnadv/s    Number   of  ICMP  Neighbor  Advertisement  messages  transmitted  per  second
                   (ipv6IfIcmpOutNeighborAdvertisements).

       The output for the flag -K provides  information  about  other  types  of  ICMPv6-messages
       (formal SNMP-names between brackets):

       iecho/s     Number    of    ICMP    Echo    (request)   messages   received   per   second
                   (ipv6IfIcmpInEchos).

       ierep/s     Number    of    ICMP    Echo-Reply    messages     received     per     second
                   (ipv6IfIcmpInEchoReplies).

       oerep/s     Number    of    ICMP    Echo-Reply    messages    transmitted    per    second
                   (ipv6IfIcmpOutEchoReplies).

       idu/s       Number  of  ICMP  Destination  Unreachable  messages   received   per   second
                   (ipv6IfIcmpInDestUnreachs).

       odu/s       Number  of  ICMP  Destination  Unreachable  messages  transmitted  per  second
                   (ipv6IfIcmpOutDestUnreachs).

       ird/s       Number of ICMP Redirect messages received per second (ipv6IfIcmpInRedirects).

       ord/s       Number    of    ICMP    Redirect    messages    transmitted     per     second
                   (ipv6IfIcmpOutRedirect).

       ite/s       Number    of    ICMP    Time    Exceeded    messages   received   per   second
                   (ipv6IfIcmpInTimeExcds).

       ote/s       Number   of   ICMP   Time   Exceeded   messages   transmitted    per    second
                   (ipv6IfIcmpOutTimeExcds).

       The  output  for the flag -U provides information about the utilization of the UDPv6-layer
       (formal SNMP-names between brackets):

       indgram/s   Number of UDPv6 datagrams per second delivered to UDP users (udpInDatagrams),

       outdgram/s  Number  of  UDPv6  datagrams  transmitted  per   second   from   this   entity
                   (udpOutDatagrams),

       inerr/s     Number  of received UDPv6 datagrams per second that could not be delivered for
                   reasons other than  the  lack  of  an  application  at  the  destination  port
                   (udpInErrors).

       noport/s    Number  of  received  UDPv6  datagrams  per  second  for  which  there  was no
                   application at the destination port (udpNoPorts).

       The output for the flag -t provides information about the  utilization  of  the  TCP-layer
       (formal SNMP-names between brackets):

       insegs/s    Number  of  received  segments  per  second, including those received in error
                   (tcpInSegs).

       outsegs/s   Number of transmitted segments per second,  excluding  those  containing  only
                   retransmitted octets (tcpOutSegs).

       actopen/s   Number  of  active  opens  per  second that have been supported by this entity
                   (tcpActiveOpens).

       pasopen/s   Number of passive opens per second that have been  supported  by  this  entity
                   (tcpPassiveOpens).

       nowopen     Number of connections currently open (snapshot), for which the state is either
                   ESTABLISHED or CLOSE-WAIT (tcpCurrEstab).

       The output for the flag -T provides information about the failures that were  detected  in
       the TCP-layer (formal SNMP-names between brackets):

       inerr/s     Number of received segments per second received in error (tcpInErrs).

       retrans/s   Number of retransmitted segments per second (tcpRetransSegs).

       attfail/s   Number  of  failed  connection  attempts per second that have occurred at this
                   entity (tcpAttemptFails).

       estabreset/s
                   Number  of  resets  per   second   that   have   occurred   at   this   entity
                   (tcpEstabResets).

       outreset/s  Number   of   transmitted   segments   per  second  containing  the  RST  flag
                   (tcpOutRsts).

       The output for the flag -O provides information about the  top-3  of  processes  with  the
       highest processor consumption:

       pid         Process-id  (if  zero,  the  process  has  exited  while  the pid could not be
                   determined).

       command     The name of the process.

       cpu%        The percentage of cpu-capacity being consumed.  This value can exceed 100% for
                   a multithreaded process running on a multiprocessor machine.

       The  output  for  the  flag  -G provides information about the top-3 of processes with the
       highest memory consumption:

       pid         Process-id (if zero, the process  has  exited  while  the  pid  could  not  be
                   determined).

       command     The name of the process.

       mem%        The percentage of resident memory-utilization by this process.

       The  output  for  the flag -D provides information about the top-3 of processes that issue
       the most read and write accesses to disk:

       pid         Process-id (if zero, the process  has  exited  while  the  pid  could  not  be
                   determined).

       command     The name of the process.

       dsk%        The  percentage of read and write accesses related to the total number of read
                   and write accesses issued on disk by all processes, so a high percentage  does
                   not imply a high disk load on system level.

       The  output  for  the flag -N provides information about the top-3 of processes that issue
       the most socket transfers for IPv4/IPv6:

       pid         Process-id (if zero, the process  has  exited  while  the  pid  could  not  be
                   determined).

       command     The name of the process.

       net%        The  percentage  of  socket transfers related to the total number of transfers
                   issued by all processes, so a high percentage does not imply  a  high  network
                   load on system level.

EXAMPLES

       To see today's cpu-activity so far (supposed that atop is logging in the background):

         atopsar

       To  see  the  memory occupation for January 2, 2010 between 10:00 and 12:30 (supposed that
       atop has been logging daily in the background):

         atopsar -m -r /var/log/atop_20100102 -b 10:00 -e 12:30

                       or

         atopsar -m -r 20100102 -b 10:00 -e 12:30

                       or, suppose it is January 5, 2010 at this moment

         atopsar -m -r yyy -b 10:00 -e 12:30

       Write a logfile with atop to record the system behaviour for 30 minutes (30 samples of one
       minute) and produce all available reports afterwards:

         atop -w /tmp/atoplog 60 30

         atopsar -A -r /tmp/atoplog

       To watch TCP activity evolve for ten minutes (10 samples with sixty seconds interval):

         atopsar -t 60 10

       To  watch  the  header-lines  ('_' as last character) of all reports with only the detail-
       lines showing critical resource consumption (marker '*' or '+' as last character):

         atopsar -AM | grep '[_*+]$'

FILES

       /etc/atoprc
            Configuration file containing system-wide default values (mainly flags).  See related
            man-page.

       ~/.atoprc
            Configuration  file  containing  personal default values (mainly flags).  See related
            man-page.

       /var/log/atop/atop_YYYYMMDD
            Daily data file, where YYYYMMDD are digits representing the date.

SEE ALSO

       atop(1), atoprc(5),
       http://www.atoptool.nl

AUTHOR

       Gerlof Langeveld (gerlof.langeveld@atoptool.nl)