ATOP(1)

📦

version 2.13.0 · 11 versions

2.13.0 · arch rolling, fedora 44, nixpkgs unstable (latest)
2.7.1 · epel 9
2.11.1 · alpine 3.22, epel 10, opensuse-leap 16.0
2.13.0 · ubuntu stonking
2.7.1 · ubuntu jammy
7.2.2 · arch rolling, fedora 43, fedora 44, ubuntu stonking
2.12.1 · alpine 3.23, alpine 3.24, fedora 43, fedora 44, nixos 26.05
2.8.1 · debian bookworm
2.10.0 · ubuntu noble
2.12.1 · ubuntu resolute
2.11.1 · debian trixie, ubuntu questing

, in arch rolling, fedora 44, nixpkgs unstable

💖 ATOP(1) 💖 — the manual for `atop`, bestie

okay so like, welcome to the atop man page, from the General Commands Manual section 🎀 this is the whole vibe, no cap.

✨ NAME ✨

atop — Advanced System & Process Monitor 🫶

🌸 SYNOPSIS 🌸

okay so there's like nine different ways to summon this thing. pick your fighter 💅

Live measurement in bar graph mode:

atop -B[H] [-t [absdir]] [interval [samples]]

Live measurement cgroups in text mode:

atop -G [-t [absdir]] [-2|-3|-4|-5|-6|-7|-8|-9] [-a] [-C|-M|-D|-A] [interval [samples]]

Live measurement processes in text mode:

atop [-t [absdir]] [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-fFX1xR] [interval [samples]]

Live generation of parsable output (white-space separated or JSON):

atop [-Plabel[,label]... [-Z]] [-Jlabel[,label]...] [interval [samples]]

Write raw log files:

atop -w rawfile [-a] [-S] [interval [samples]]

Analyze raw log files in bar graph mode:

atop -B[H] -r [rawfile|yyy...] [-b [YYYYMMDD]hhmm[ss]] [-e [YYYYMMDD]hhmm[ss]]

Analyze cgroups from raw log files in text mode:

atop -G [-2|-3|-4|-5|-6|-7|-8|-9] [-a] -r [rawfile|yyy...] [-b [YYYYMMDD]hhmm[ss]] [-e [YYYYMMDD]hhmm[ss]]

Analyze processes from raw log files in text mode:

atop -r [rawfile|yyy...] [-b [YYYYMMDD]hhmm[ss]] [-e [YYYYMMDD]hhmm[ss]] [-g|-m|-d|-n|-u|-p|-s|-c|-v|-o|-y|-Y] [-C|-M|-D|-N|-A] [-fFX1xR]

Generate parsable output from raw log files (white-space separated or JSON):

atop -r [rawfile|yyy...] [-b [YYYYMMDD]hhmm[ss]] [-e [YYYYMMDD]hhmm[ss]] [-Plabel[,label]... [-Z]] [-Jlabel[,label]...]

🦋 DESCRIPTION 🦋

so atop is this interactive monitor that lets you peek at the load on a Linux system 👀 every interval seconds — and bestie, the default is 10 seconds — it goes and gathers info about the resource occupation at the system level (that's CPUs, memory, disks and network interfaces) and at the cgroup level (version 2, iykyk).

and that's not even all of it — it also gathers info about the processes and threads that are the ones actually responsible for using up the CPUs, memory and disks 🔥

ok important caveat bestie: network load per process only shows up when the netatop kernel module or the netatop-bpf BPF module has been installed. no module, no per-process network tea 💀

🧚 TWIN MODE 🧚

with the -t flag you can run atop interactively in what's called 'twin mode' ✨ and honestly? iconic. this mode lets you run a live measurement and have the possibility to review and analyze an earlier sample at the same time. meanwhile, the live measurement just keeps going. main character energy fr fr 👑

when it's started in twin mode, atop spawns a child process that gathers the counters and writes them to a temporary raw file 📝 the parent process reads the counters from that temporary raw file and presents them to you, the user. and the reading of the parent process keeps in pace with the written samples of the child process for live measurements — they're literally in sync, we love a coordinated duo 🫶

while the gathering continues by the child process, you can press key r, key b or key T to review earlier samples. the parent process implicitly pauses the live measurement when you press one of these keys — or when you press key z (pause) explicitly, if you wanna be direct about it 💅

and after you've been browsing through the earlier samples with the keys t (next sample), T (previous sample), r (reset to begin of measurement), Z (fast-forward to end of measurement) and b (branch to timestamp), you can continue the live measurement by pressing key z (resume after pause) 🙈 and we're back, periodt.

the temporary raw file gets written in the /tmp directory by default. optionally you can add the absolute path name of an alternative directory behind the -t flag (like, e.g. when there's not enough space in the /tmp directory, been there 😭). in any case, the parent process will terminate the child process when the measurement is finished and the temporary raw file will be removed 🎀 clean up after yourself, we stan.

🌈 BAR GRAPH MODE 🌈

Okay bestie, so when you're running atop you've got two whole vibes to pick from: bar graph mode or text mode. In bar graph mode, the resource utilization of CPUs, memory, disks and network interfaces is shown via (character-based) bar graphs — but lowkey only on system level. When you want more detailed info on system level, or when you're feeling nosy and want the resource consumption on process or thread level, you switch to text mode by pressing the B key. And alternatively, you can use the B key (again) to switch from text mode to bar graph mode. Toggle queen 💅✨

By default, atop starts in text mode unless the -B flag is used or unless B has been configured as a default flag in the .atoprc file (for further info about default flags, go read the atoprc man page, iykyk).

In bar graph mode the terminal gets subdivided into four character-based windows, i.e. one window for each hardware resource:

💻 Processors 💻

The first bar shows the average busy percentage of all CPUs with the bar label Avg (might be abbreviated to Av or even just A — she's shrinking under pressure 🫶). The subsequent bars show the busy percentages of single CPUs.
When there's not enough horizontal space to show all CPUs, only the most busy CPUs per sample will be shown, after the width of each bar has been reduced to a minimum.
By default, the categories of CPU consumption are shown by different colors in the bars, marked with a character S (system mode), U (user mode), I (interrupt handling), s (steal) and G (guest, i.e. consumed by virtual machines).
The top of the bar might consist of an unmarked color representing a neutral category. Suppose that the scale unit is 5% per line and the total busy percentage is 54% consisting of two categories of 27%. The two categories will be rounded to 25% (5 lines of 5% each) but the total busy percentage will be rounded to 55% (11 lines of 5%). Then the top line will represent a neutral category. Math is mathing ✨
By pressing the H key or by starting atop with the -H flag, no categories are shown.
A red line is drawn in the bar graph as critical threshold 🚨. By default this value is 90% and can be modified by the cpucritperc option in the configuration file (see separate atoprc man page). When this value is set to zero, no threshold line will be drawn.

🧠 Memory and swap space 🧠

Memory is presented as a column in which the specific categories of memory consumption are shown. These categories are (code, data and stack of) processes/kernel, slab caches (i.e. dynamically allocated kernel memory), shared memory, tmpfs, static huge pages, page cache and free memory.
At the left side of the memory column, a vertical green line shows the memory which is available (i.e. reclaimable) for allocations per category without causing swapping or heavy reclaim. This is a categorized breakdown of the available memory value that is shown as avail in the MEM line of the text mode.
Swap space (if present) is presented as another column in which the categories processes/tmpfs, shared memory and free space are shown.
At the right side, memory-related event counters are shown. The bottom three counters are colored green when there's no memory pressure. When considerable activity is noticed such counter might be colored orange, and with high activity, red 🍓.
When memory pressure starts, usually memory page scanning will be activated first. When pressure increases, memory pages of processes might be swapped out to swap space (if present).
The oomkills counter (Out Of Memory killing) is the most serious one 💀: it reflects the number of processes that are killed due to lack of memory (and swap). Therefore this counter shows the absolute number (not per second) of processes being killed during the last interval and will immediately be colored red when it is 1 or more. Besides, after atop has noticed OOM killing, the oomkills counter remains orange for the next 15 minutes, just in case you missed the OOM killing event itself. She's not letting you forget, bestie 😭
When there's enough vertical space in the memory window, event counters are shown about the number of memory pages being swapped in, the number of memory pages paged out to block devices and the number of memory pages paged in from block devices.
Memory and swap space consumption will preferably be shown in a character-based window that vertically uses the entire screen for optimal granularity. However, when there are a lot of disks and/or network interfaces, the memory and swap space consumption will be shown in a character-based window that only uses the upper half of the screen.

💾 Disks 💾

For each disk, the busy percentage is shown as a bar. When there's not enough horizontal space to show all disks, only the most busy disks per sample will be shown.
By default, categories of disk consumption are shown by different colors in the bars, marked with a character R (read) and W (write).
The top of the bar might consist of an unmarked color representing a neutral category. Suppose that the scale unit is 5% per line and the total busy percentage is 54% consisting of two categories of 27%. The two categories will be rounded to 25% (5 lines of 5% each) but the total busy percentage will be rounded to 55% (11 lines of 5%). Then the top line will represent a neutral category. (Yes, same rounding situation as the CPUs — she's consistent 💅)
By pressing the H key or by starting atop with the -H flag, no categories are shown.
A red line is drawn in the bar graph as critical threshold 🚨. By default this value is 90% and can be modified by the dskcritperc option in the configuration file (see separate atoprc man page). When this value is set to zero, no threshold line will be drawn.

📡 Interfaces 📡

For each non-virtual network interface a double bar graph is shown with a dedicated scale that reflects the traffic rate. One of the bars shows the transmit rate (TX) and the other bar the receive rate (RX). The traffic scale of each network interface remains at its highest level. All interface scales can be reset during the measurement by pressing the L key 🔥.
Most often the real speed (maximum bandwidth) of network interfaces is not known, e.g. in case of the network interfaces of virtual machines. Therefore it's not possible to show the interface utilization as a percentage. However, when the real speed of an interface is known, it will be shown underneath the concerning bar graph.
When there's not enough horizontal space to show all network interfaces, only the most busy interfaces per sample will be shown.

Usually the bar graphs will not be sorted on busy percentage when there's enough horizontal space. However, after switching from text mode to bar graph mode the bar graphs might have been sorted, because this was needed for the presentation in text mode. The next interval in bar graph mode shows the bars unsorted again — unless the window width is unsufficient for all bars. Girlypop can only shrink so much 🫠

For the CPUs, disks and memory resources, also a bar graph with two bars is shown, reflecting the PSI values some (S) and full (F). The some (S) percentage indicates the time in which at least some tasks were stalled on a given resource. The full (F) percentage indicates the time in which all non-idle tasks were stalled on this resource simultaneously, which had severe impact on the performance 😬.

Heads up 🎀 — for some Linux distributions PSI support might be disabled by default. In that case you need to pass psi=1 on the kernel command line during boot.

The remaining part of this manual page mainly describes the information shown in text mode. When certain descriptions also apply to bar graph mode, it will be mentioned explicitly. Noted, bestie 📝✨

✨ TEXT MODE IN GENERAL ✨

okay so bestie, every single interval, atop shows you the tea about resource occupation on the system level — CPU, memory, disks and network layers — up in the upper part of the screen. if a resource was literally unused during that interval, its line gets suppressed unless the f key is active. no wasted screen space, we love that.

in the bottom part of the screen you get cgroup level info (that's the G key) or process level info (the g, c, s, m, d, n, v, u or p keys). by default, only cgroups are shown without assigned processes in the cgroup itself nor in the cgroups underneath, unless the a key (all) is active. and by default, only processes that were active during the interval are shown, unless the a key (all) is active. the intervals keep repeating till the number of samples (specified as a command argument) is reached, or till the q key is pressed in interactive mode. periodt.

when atop starts, it checks whether the standard output channel is connected to a screen, or to a file/pipe. in the first case it produces screen control codes (via the ncurses library) and behaves interactively. in the second case it produces flat text output. very demure, very mindful.

in interactive mode, the output of atop scales dynamically to the current dimensions of the screen/window. if the window is resized horizontally, columns get added or removed automatically. for this purpose, every column has a particular weight — the columns with the highest weights that fit within the current width will be shown. if the window is resized vertically, lines of the process/thread list get added or removed automatically. it's giving responsive design before responsive design was a thing.

in interactive mode the output of atop can be controlled by pressing particular keys. however, it's also possible to specify such a key as a flag on the command line. in that case atop switches to the indicated mode on beforehand. this mode can be modified again interactively. specifying such a key as a flag is especially useful when running atop with output to a pipe or file (non-interactively). these flags are the same as the keys that can be pressed in interactive mode (see section INTERACTIVE COMMANDS). additional flags are available to support storage of atop-data in raw format (see section RAW DATA STORAGE).

by default, atop produces its output full-screen unless a flag is passed to direct the output to a raw log (-w) or direct the output in parseable (-P) or JSON output (-J). it is possible however to produce full-screen output while the output is also directed in another way. in that case a flag that relates to full-screen output (like -g) has to be passed on the command line explicitly. iykyk.

the status line in the initial screen shows if atop runs with restricted view (as unprivileged user) or unrestricted view (as privileged user). in case of restricted view, atop does not have the privileges (no root identity nor the necessary capabilities) to retrieve all counter values on system level and on process level. so yeah, no root no full tea. 💅

🧾 PROCESS ACCOUNTING 🧾

with every interval, atop reads the kernel administration to obtain information about all running processes. however, it is likely that processes have terminated during the interval. these processes might have consumed system resources during this interval before they terminated. therefore, atop tries to read the process accounting records that contain the accounting information of terminated processes and report these processes too. only when the process accounting mechanism in the kernel is activated, the kernel writes such a process accounting record to a file for every process that terminates. okay so far? good.

there are various ways for atop to get access to the process accounting records (tried in this order):

when the environment variable ATOPACCT is set, it specifies the name of the process accounting file. in that case, process accounting for this file should have been activated on beforehand. before opening this file for reading, atop drops its root privileges (if any). when this environment variable is present but its contents is empty, process accounting will not be used at all.
this is the preferred way of handling process accounting records! when the atopacctd daemon is active, it has activated the process accounting mechanism in the kernel and transfers the original accounting records to shadow files. in that case, atop drops its root privileges and opens the current shadow file for reading. this way is preferred because the atopacctd daemon maintains full control of the size of the original process accounting file written by the kernel and the shadow files read by the atop process(es).

the atopacct service will be activated before the atop service to enable atop to detect that process accounting is managed by the atopacctd daemon. as a forking service, atopacctd takes care that all directories and files are initialized before the parent process dies. the child process continues as the daemon process.

for further information, refer to the atopacctd man page.

when the atopacctd daemon is not active, atop verifies if the process accounting mechanism has been switched on via the separate psacct or acct package (the package name depends on the Linux distro). in that case, one of the files /var/log/pacct, /var/account/pacct or /var/log/account/pacct is in use as process accounting file and atop opens this file for reading.
as a last possibility, atop itself tries to activate the process accounting mechanism (requires root privileges) using the file /var/cache/atop.d/atop.acct (to be written by the kernel, to be read by atop itself). process accounting remains active as long as at least one atop process is alive. whenever the last atop process stops (either by pressing q or by kill -15), it deactivates the process accounting mechanism again.

🚨 bestie, never terminate atop by kill -9, because then it has no chance to stop process accounting. as a result, the accounting file may consume a lot of disk space after a while.

to avoid that the process accounting file consumes too much disk space, atop verifies at the end of every sample if the size of the process accounting file exceeds 200 MiB and if this atop process is the only one that is currently using the file. in that case the file is truncated to a size of zero.

notice that root-privileges are required to switch on/off process accounting in the kernel. you can start atop as a root user or specify setuid-root privileges to the executable file. in the latter case, atop switches on process accounting and drops the root-privileges again.

if atop does not run with root-privileges, it does not show information about finished processes. it indicates this situation with the message no procacct in the top-right corner (instead of the counter that shows the number of exited processes).

when during one interval a lot of processes have finished, atop might grow tremendously in memory when reading all process accounting records at the end of the interval. to avoid such excessive growth atop will never read more than 50 MiB with process information from the process accounting file per interval (approx. 54000 finished processes). in interactive mode a warning is given whenever processes have been skipped for this reason. we love a memory-safe queen. 🫶

🌈 COLORS 🌈

for the resource consumption on system level, atop uses colors in text mode to indicate that a critical occupation percentage has been (almost) reached. a critical occupation percentage means that it is likely that this load causes a noticeable negative performance influence for applications using this resource. the critical percentage depends on the type of resource: e.g. the performance influence of a disk with a busy percentage of 80% might be more noticeable for applications/users than a CPU with a busy percentage of 90%. it's giving "not all resources are built the same."

currently atop uses the following default values to calculate a weighted percentage per resource:

Processor — a busy percentage of 90% or higher is considered 'critical' (also in bar graph mode).
Disk — a busy percentage of 90% or higher is considered 'critical'.
Network — a busy percentage of 90% or higher for the load of an interface is considered 'critical'.
Memory — an occupation percentage of 90% is considered 'critical'. notice that this occupation percentage is the accumulated memory consumption of the kernel (including slab) and all processes. the memory for the page cache (cache and buff in the MEM-line) and the reclaimable part of the slab (slrec) is not implied! if the number of pages swapped out (swout in the PAG-line) is larger than 10 per second, the memory resource is considered 'critical'. a value of at least 1 per second is considered 'almost critical'. if the committed virtual memory exceeds the limit (vmcom and vmlim in the SWP-line), the SWP-line is colored due to overcommitting the system.
Swap — an occupation percentage of 80% is considered 'critical' because swap space might be completely exhausted in the near future. it is not critical from a performance point-of-view.

these default values can be modified in the configuration file (see separate atoprc man page).

when a resource exceeds its critical occupation percentage, the concerning values in the screen line are colored red by default. when a resource exceeds (by default) 80% of its critical percentage (so it is almost critical), the concerning values in the screen line are colored cyan by default. this 'almost critical percentage' (one value for all resources) can be also modified in the configuration file (see separate atoprc man page). the default colors red and cyan can be modified in the configuration file as well (see separate atoprc man page). customizable color coding? obsessed. 🎀

with the key x (or flag -x), the use of colors can be suppressed in text mode. the use of colors is however mandatory in case of bar graph mode. so if you're in bar graph mode, the rainbow stays. 🌈

🦋 NETATOP OR NETATOP-BPF MODULE 🦋

okay so you want the network tea per-process AND per-thread? bestie, that's literally what the netatop kernel module or the netatop-bpf BPF module is for, and yes they can be installed separately. 💅

When atop has been started with the '-K' flag, it verifies if the netatop or netatop-bpf module is currently active. If so, atop obtains the relevant network counters from this module for each interval and shows the number of sent and received packets per process/thread in the generic screen. Besides, detailed counters can be requested by pressing the 'n' key.

When the netatopd daemon is running in combination with the netatop module, atop also reads the network counters of exited processes that are logged by this daemon (comparable with process accounting). so it's giving process-accounting-but-for-network, iconic honestly.

More information about the optional netatop kernel module and the netatopd daemon can be found in the concerning man-pages and on the website mentioned at the end of this manual page. 🫶

🔥 GPU STATISTICS GATHERING 🔥

GPU statistics can be gathered by atopgpud which is a separate data collection daemon process. It gathers cumulative utilization counters of every Nvidia GPU in the system, as well as utilization counters of every process that uses a NVIDIA GPU. When atop has been started with the '-k' flag, it reads these GPU utilization counters with every interval when the daemon is active. 🎀

The atopgpud daemon is written in Python, so a Python interpreter should be installed on the target system. For the gathering of the statistics, the pynvml module is used by the daemon. Be sure that this module is installed on the target system before activating the daemon, by running the command pip as root user:

pip install nvidia-ml-py

The atopgpud daemon is installed by default as part of the atop package, but it is not automatically enabled. The daemon can be enabled and started now by running the following commands (as root):

systemctl enable atopgpu
systemctl start atopgpu

Find a description about the utilization counters in the section OUTPUT DESCRIPTION. 👑

⭐ INTERACTIVE COMMANDS ⭐

When running atop interactively (no output redirection), keys can be pressed to control the output. Certain keys can be used to show other information (other columns) for the active processes. Some of these keys can also be used to switch directly from bar graph mode to particular detailed process information in text mode. Other keys can be used to influence the sort order of the active process/thread list (keys 'C', 'M', 'D', 'N', 'E' or 'O'). yes bestie, you're the main character and the keyboard is your wand. ✨

g — Show generic output (default).

Per process the following fields are shown in case of a window-width of 80 positions: process-id, CPU consumption during the last interval in system and user mode, the virtual and resident memory growth of the process. The data transfer per process for read/write on disk can only be shown when atop runs with root privileges. When the optional module netatop or netatop-bpf is loaded, the data transfer for send/receive of network packets is shown for each process. The last columns contain the state, the occupation percentage for the chosen resource (default: CPU) and the process name.

When more than 80 positions are available, other information is added. 🦋

m — Show memory related output.

Per process the following fields are shown in case of a window width of 80 positions: process-id, minor and major memory faults, size of virtual shared text, total virtual process size, total resident process size, virtual and resident growth during last interval, memory occupation percentage and process name.

When more than 80 positions are available, other information is added.

For memory consumption, always all processes are shown (also the processes that were not active during the interval). no skipping bestie, everybody's invited to this party 💖

d — Show disk-related output.

When atop runs with root privileges, the following fields are shown: process-id, amount of data read from disk, amount of data written to disk, amount of data that was written but has been withdrawn again (WCANCL), disk occupation percentage and process name.

n — Show network related output.

Per process the following fields are shown in case of a window width of 80 positions: process-id, thread-id, total bandwidth for received packets, total bandwidth for sent packets, number of received TCP packets with the average size per packet (in bytes), number of sent TCP packets with the average size per packet (in bytes), number of received UDP packets with the average size per packet (in bytes), number of sent UDP packets with the average size per packet (in bytes), the network occupation percentage and process name. This information can only be shown when the optional module netatop or netatop-bpf is installed. lowkey a whole paragraph of numbers but it's giving detail, okurr 💅

When more than 80 positions are available, other information is added.

s — Show scheduling characteristics.

Per process the following fields are shown in case of a window width of 80 positions: process-id, number of threads in state 'running' (R), number of threads in state 'interruptible sleeping' (S), number of threads in state 'uninterruptible sleeping' (D), number of threads in state 'idle' (I), scheduling policy (normal timesharing, realtime round-robin, realtime fifo), nice value, priority, realtime priority, current processor, status, exit code, state, the occupation percentage for the chosen resource and the process name.

When more than 80 positions are available, other information is added.

v — Show various process characteristics.

Per process the following fields are shown in case of a window width of 80 positions: process-id, user name and group, start date and time, status (e.g. exit code if the process has finished), state, the occupation percentage for the chosen resource and the process name. 🍓

When more than 80 positions are available, other information is added.

c — Show the command line of the process.

Per process the following fields are shown: process-id, the occupation percentage for the chosen resource and the command line including arguments. the way this shows you exactly what gremlin program is eating your CPU >>>

G — Show cgroup v2 information.

Show a hierarchical structure of cgroups and related metrics. Optionally, the processes assigned to each cgroup can be shown. With the keys/flags '2' till '7' the level depth of the cgroups can be chosen ('7' is default). With key/flag '8' the assigned active processes are shown as well, except the kernel processes (usually in the root cgroup). With key/flag '9' all active processes are shown, including the kernel processes.

With key/flag 'a' (toggle) all cgroups and all processes are shown instead of only the active cgroups and processes. A cgroup is considered inactive when no processes are assigned to that cgroup nor to the cgroups underneath.

With key/flag 'C' the output is sorted on CPU consumption, with key/flag 'M' sorted on memory consumption and with key/flag 'D' sorted on disk consumption. 🌈

e — Show GPU utilization.

Per process at least the following fields are shown: process-id, range of GPU numbers on which the process currently runs, GPU busy percentage on all GPUs, memory busy percentage (i.e. read and write accesses on memory) on all GPUs, memory occupation at the moment of the sample, average memory occupation during the sample, and GPU percentage. ⚡

o — Show the user-defined line in the process list.

In the configuration file the keyword ownprocline can be specified with the description of a user-defined output-line. Refer to the man-page of atoprc for a detailed description. build your own line, be the architect of your own destiny fr fr 🎀

y — Show the individual threads within a process (toggle).

Single-threaded processes are still shown as one line. For multi-threaded processes, one line represents the process while additional lines show the activity per individual thread (in a different color). Depending on the option 'a' (all or active toggle), all threads are shown or only the threads that were active during the last interval. Depending on the option 'Y' (sort threads), the threads per process will be sorted on the chosen sort criterium or not. Whether this key is active or not can be seen in the header line. 👀

Y — Sort the threads per process when combined with option 'y' (toggle).
u — Show the process activity accumulated per user.

Per user the following fields are shown: number of processes active or terminated during last interval (or in total if combined with command 'a'), accumulated CPU consumption during last interval in system and user mode, the current virtual and resident memory space consumed by active processes (or all processes of the user if combined with command 'a'). When atop runs with root privileges, the accumulated read and write throughput on disk is shown. When the optional module netatop or netatop-bpf has been installed, the accumulated number of received and sent network packets is shown. The last columns contain the accumulated occupation percentage for the chosen resource (default: CPU) and the user name. 🫶

p — Show the process activity accumulated per program (i.e. process name).

Per program the following fields are shown: number of processes active or terminated during last interval (or in total if combined with command 'a'), accumulated CPU consumption during last interval in system and user mode, the current virtual and resident memory space consumed by active processes (or all processes of the user if combined with command 'a'). When atop runs with root privileges, the accumulated read and write throughput on disk is shown. When the optional module netatop or netatop-bpf has been installed, the accumulated number of received and sent network packets is shown. The last columns contain the accumulated occupation percentage for the chosen resource (default: CPU) and the program name.

j — Show the process activity accumulated per container/pod. 🐳

Okay so per container (think Docker/Podman) or per pod (think Kubernetes), here's the lil field lineup you get 🫶:

the number of processes that were active or terminated during the last interval (or in total if you've combined it with the a command, iykyk)
accumulated CPU consumption during the last interval, split into system and user mode
the current virtual and resident memory space eaten up by active processes (or all processes of the user if combined with a)

When atop runs with root privileges, the accumulated read and write throughput on disk gets shown too. And when the optional netatop or netatop-bpf module is installed, you also get the accumulated number of received and sent network packets. ✨

The last columns are literally the accumulated occupation percentage for whichever resource you chose (default is CPU) plus the container/pod name (CID/POD). Slay.

O — define the sorting order of the process list based on a specific column (case insensitive, bestie, don't worry) and set whether sorting goes ascending or descending (descending is the most logical choice and it's the default). Heads up: the column you pick has to be part of the current process view — either visible or unvisible (when the screen is too narrow to show the column, yeah that happens 😭).

And for the shortcut girlies: selecting column CPU in descending order is equivalent to pressing C, column MEM in descending order is equivalent to pressing M, column DSK in descending order is equivalent to pressing D, column NET in descending order is equivalent to pressing N, and selecting column GPU in descending order is equivalent to pressing E. Chemistry. 💅

C — sort the current list by CPU consumption (this is the default, she's the main character). The one-but-last column changes to CPU.
E — sort the current list by GPU utilization. The one-but-last column changes to GPU.
M — sort the current list by resident memory consumption. The one-but-last column changes to MEM. Lowkey important: when you're sorting on memory, the full process list gets shown, not just the active processes.
D — sort the current list by disk accesses issued. The one-but-last column changes to DSK.
N — sort the current list by network bandwidth (received and transmitted, both of 'em). The one-but-last column changes to NET.

🌈 Miscellaneous interactive commands 🌈

? — request help information (you can also press h, same vibe).
V — request version information (that's the version number and date).
R — gather and calculate the proportional set size of processes (toggle). Warning bestie: gathering all the values needed to calculate the PSIZE of a process is a very time-consuming task, so only have this active when you're actually analyzing the resident memory consumption of processes. Don't just leave it on for the aesthetic, it's not worth it 😭
W — get the WCHAN per thread (toggle). Same deal — gathering the WCHAN string per thread is a relatively time-consuming task, so only turn this on when you're analyzing why threads are in sleep state. Investigative queen behavior only.
x — suppress colors that highlight critical resources (toggle). Whether this key is active or not can be seen in the header line, so peek up there 👀
z — the pause key, use it to freeze the current situation so you can actually investigate the output on your screen. While atop is paused, you can press all the keys described above to show other info about the current list of processes 🧚 Whenever you press the pause key again, atop continues with a next sample. Works in text mode and bar graph mode.
i — modify the interval timer (default: 10 seconds). If you enter an interval timer of 0, the timer switches off entirely. In that case a new sample can only be triggered manually by pressing t. The interval can be modified in text mode and bar graph mode.
t — trigger a new sample manually. Press it when the current sample should finish before the timer has exceeded, or when no timer is set at all (interval timer defined as 0). In that no-timer case, atop can be used as a stopwatch to measure the load caused by a particular application transaction — without knowing beforehand how many seconds that transaction will last. Iconic, honestly. Works in text mode and bar graph mode.

When viewing the contents of a raw file, this key shows the next sample from the file. It also works when viewing raw data via a pipe.

T — when viewing the contents of a raw file, this key shows the previous sample from the file — but not when reading raw data from a pipe. Works in text mode and bar graph mode.
b — when viewing the contents of a raw file, branch to a certain timestamp within the file, either forward or backward. When viewing raw data from a pipe, only forward branches are possible. Works in text mode and bar graph mode.
r — reset all counters to zero so you can see the system and process activity since boot again. Works in text mode and bar graph mode.

When viewing the contents of a raw file, this key rewinds to the beginning of the file again (except when reading raw data from a pipe).

Z — when viewing the contents of a raw file, fast-forward to the end of the file — however not when reading raw data from a pipe. Works in text mode and bar graph mode.
U — specify a regular expression string for specific user names, or a numerical UID. From then on, only (active) processes from a user matching that regex or numerical UID get shown. The system statistics are still system wide, no cap. If you press Enter without specifying a name, (active) processes of all users show up again. Whether this key is active or not can be seen in the header line.
I — specify a list with one or more PIDs to be selected. From then on, only processes with a PID matching one of the given list get shown. System statistics stay system wide. If you press Enter without specifying a PID, all (active) processes show up again. Header line tells you if it's active.
P — specify a search string for specific process names as a regular expression. From then on, only processes with a name matching the regex get shown. System stats still system wide. Enter with no name → all (active) processes back. Check the header line for active status.
/ — specify a specific command line search string as a regular expression. From then on, only processes with a command line matching the regex get shown. System stats still system wide. Enter with no string → all (active) processes again. Header line shows if it's active.
J — specify a container id (e.g. Docker or Podman) or pod name (e.g. Kubernetes) of maximum 15 characters. If the name is longer, the last 15 characters are what's expected. From then on, only processes running in that specific container or pod get shown. System stats still system wide. Enter with nothing → all (active) processes again. Header line = active status check 👑
Q — specify a comma-separated list of process/thread state characters. From then on, only processes/threads in those specific states get shown. Accepted states are: R (running), S (sleeping), D (disk sleep), I (idle), T (stopped), t (tracing stop), X (dead), Z (zombie) and P (parked). System stats still system wide. Enter with no state → all (active) processes/threads again. Header line tells you if it's active.
S — specify search strings for specific logical volume names, specific disk names and specific network interface names. All search strings are interpreted as regular expressions. From then on, only the system resources matching the concerning regex get shown. Enter with no search string → all (active) system resources of that type again. Header line tells you if it's active.
a — the 'all/active' key, toggles between only showing/accumulating the processes that were active during the last interval (this is the default) and showing/accumulating all processes. Whether it's active can be seen in the header line.
X — by default, atop shows/accumulates the processes that are alive and the processes that exited during the last interval. With this key (toggle), showing/accumulating the exited processes can be suppressed. Header line shows if it's active.
f — show a fixed (maximum) number of header lines for system resources (toggle). By default only the lines about system resources that really were active during the last interval get shown (CPUs, paging, logical volumes, disks, network interfaces). With this key you can force atop to show lines of inactive resources too. Header line tells you if it's active.
F — suppress sorting of system resources (toggle). By default, system resources (CPUs, logical volumes, disks, network interfaces) are sorted on utilization. Header line tells you if it's active.
1 — show relevant counters as an average per second (in the format '..../s') instead of as a total during the interval (toggle). Whether this key is active or not can be seen in the header line. 🍓
l — lowkey the "bestie, calm down" key 🌸 it caps how many system-level lines you get for the per-cpu counters, the active disks and the network interfaces. By default you see lines for all CPUs, disks and network interfaces that were active during the last interval — which is slay until you're on a box with a million CPUs and your terminal is 24 lines tall 😭. Limiting these lines is exactly for that. For all the resources mentioned, the max number of lines can also be set interactively. When you use the -l flag, the max number of per-cpu lines is set to 0, the max number of disk lines to 5 and the max number of interface lines to 3. And yes, those values can be modified again in interactive mode 💅
k — send a signal to an active process (a.k.a. kill a process) 💀
q — quit the program, bestie, we're done here. This key works in text mode and bar graph mode 👑
PgDn — show the next page of the process/thread list. With the arrow-down key the list can be scrolled downwards with single lines 🦋
^F — show the next page of the process/thread list (forward). With the arrow-down key the list can be scrolled downwards with single lines ✨
PgUp — show the previous page of the process/thread list. With the arrow-up key the list can be scrolled upwards with single lines 🦋
^B — show the previous page of the process/thread list (backward). With the arrow-up key the list can be scrolled upwards with single lines ✨
^L — redraw the screen, because sometimes the vibe gets messed up and you just need a fresh start 🎀

🌈 RAW DATA STORAGE 🌈

Okay so this is the part where atop becomes a whole archivist 🫶. If you want to keep system and process level statistics around for long-term analysis — like, say, checking the system load and which processes were running yesterday between 3:00 and 4:00 PM — atop can store all that system and process level data in compressed binary format in a raw file. You do it with the flag -w followed by the filename 💖

If that file already exists and is recognized as a raw data file, atop will append new samples to it (starting with a sample which reflects the activity since boot). If the file does not exist, it will be created ✨

All information about system, processes and thread activity is stored in the raw file. All of it. The whole lore 📚

The interval (default: 10 seconds) and number of samples (default: infinite) can be passed as last arguments. And instead of the number of samples, you can use the flag -S to tell atop that it should finish anyhow before midnight ⏰

A raw file can be read and visualized again with the flag -r followed by the filename. The details here are kinda specific so let's go through them:

If no filename is specified, the file /var/log/atop/atop_YYYYMMDD is opened for input (where YYYYMMDD are digits representing the current date).
If a filename is specified in the format YYYYMMDD (representing any valid date), the file /var/log/atop/atop_YYYYMMDD is opened.
If a filename with the symbolic name y is specified, yesterday's daily logfile is opened — and this can be repeated, so yyyy indicates the logfile of four days ago 👵
If the filename - is used, stdin will be read.

The samples from the file can be viewed interactively using:

the key t to show the next sample
the key T to show the previous sample
the key b to branch to a particular time
the key r to rewind to the begin of the file
the key Z to fast-forward to the end of the file

These keys work in text mode as well as in bar graph mode, no cap 💅

When output is redirected to a file or pipe, atop prints all samples in plain ASCII. The default line length is 80 characters in that case. With the flag -L followed by an alternate line length, more (or less) columns will be shown 📏

With the flag -b (begin time) and/or -e (end time) followed by a time argument of the form [YYYYMMDD]hhmm[ss], a certain time period within the raw file can be selected 🕰️

Every day at midnight atop is restarted by the atop-rotate.timer and atop-rotate.service unit files, to write compressed binary data to the file /var/log/atop/atop_YYYYMMDD with an interval of 10 minutes by default. Furthermore all raw files are removed that are older than 28 days (by default) 🗑️

The mentioned default values can be overruled in the file /etc/default/atop, which might contain other values for:

LOGOPTS (by default without any flag)
LOGINTERVAL (in seconds, by default 600)
LOGGENERATIONS (in days, by default 28)
LOGPATH (directory in which logfiles are stored)

Unfortunately, it is not always possible to keep the format of the raw files compatible in newer versions of atop, especially when many new counters have to be maintained 😭. Therefore, the program atopconvert is installed to convert a raw file created by an older version of atop to a raw file that can be read by a newer version of atop (see the man page of atopconvert for more details). Honestly? Iconic of them to give us a converter instead of just letting us suffer 🫶

💖 OUTPUT DESCRIPTION 💖

The header line always shows:

the host name
the end date and end time when the sample has been taken
the current options that are active (only in text mode)
the elapsed time (duration) of the sample

The verb PAUSED will be shown behind the time when atop is currently paused with the z key ⏸️

The first sample shows the system level activity since boot (the elapsed time in the header shows the time since boot). So like, the first one is always a little extra 🌱

In text mode, atop first shows the lines related to system level activity for every sample. If a particular system resource has not been used during the interval, the entire line related to this resource is suppressed 🙈. So the number of system level lines may vary for each sample — it's giving dynamic layout, honestly.

After that, a list is shown of processes which have been active during the last interval. This list is sorted on CPU consumption by default, but this order can be changed by the keys which are previously described 👑

If values have to be shown by atop which do not fit in the column width, another format is used. Examples, because examples slay:

If a CPU consumption of 233216 milliseconds should be shown in a column width of 4 positions, it is shown as '233s' (in seconds).
For large memory figures, another unit is chosen if the value does not fit (Mb instead of Kb, Gb instead of Mb, Tb instead of Gb, etcetera).
For other values, a kind of exponent notation is used (value 123456789 shown in a column of 5 positions gives 123e6).

🔥 OUTPUT DESCRIPTION - SYSTEM LEVEL 🔥

The system level information in text mode consists of the following output lines:

💅 PRC — Process and thread level totals.

This line contains:

the total CPU time consumed in system mode ('sys') and in user mode ('user')
the total number of processes present at this moment ('#proc')
the total number of threads present at this moment in state 'running' ('#trun'), 'sleeping interruptible' ('#tslpi'), 'sleeping uninterruptible' ('#tslpu') and 'idle' ('#tidle')
the number of zombie processes ('#zombie')
the number of clone system calls ('clones')
the number of processes that ended during the interval ('#exit') when process accounting is used

Instead of '#exit' the last column may indicate that process accounting could not be activated ('no procacct'). And if the screen-width does not allow all of these counters, only a relevant subset is shown — it's giving "we trimmed it for the algorithm" 😌

👑 CPU — CPU utilization.

At least one line is shown for the total occupation of all CPUs together ✨

In case of a multi-processor system, an additional line is shown for every individual processor (with 'cpu' in lower case), sorted on activity. By default, inactive CPUs will not be shown — nobody wants to hear from the CPU that's just lying there napping 💤. The lines showing the per-cpu occupation contain the CPU number in the column combined with the wait percentage.

Beware that the percentages for the total occupation of all CPUs together ('CPU' in upper case) are not reliable when CPUs have been enabled or disabled during the interval! 🚨 No cap, that one's a real caveat.

Every line contains:

the percentage of CPU time spent in kernel mode by all active processes ('sys')
the percentage of CPU time consumed in user mode ('user') for all active processes (including processes running with a nice value larger than zero)
the percentage of CPU time spent for interrupt handling ('irq') including softirq
the percentage of unused CPU time while no processes were waiting for disk I/O ('idle')
the percentage of unused CPU time while at least one process was waiting for disk I/O ('wait')

In case of per-cpu occupation, the CPU number and the wait percentage ('wa') for that CPU are combined. The number of lines showing the per-cpu occupation can be limited 🔒

For virtual machines, the steal-percentage ('steal') shows the percentage of CPU time stolen by other virtual machines running on the same hardware 😤 rude.

For physical machines hosting one or more virtual machines, the guest percentage ('guest') shows the percentage of CPU time used by the virtual machines. Notice that this percentage overlaps the user percentage! 🫶

When PMC performance monitoring counters are supported by the CPU and the kernel (and atop runs with root privileges), the number of instructions per CPU cycle ('ipc') is shown. The first sample always shows the value 'initial', because the counters are just activated at the moment that atop is started — it's literally brand new, give it a sec 🌱. This also happens in the first sample after CPUs have been enabled or disabled.

Reading the IPC, bestie:

When the CPU busy percentage is high and the IPC is less than 1.0, it is likely that the CPU is frequently waiting for memory access during instruction execution (larger CPU caches or faster memory might be helpful to improve performance).
When the CPU busy percentage is high and the IPC is greater than 1.0, it is likely that the CPU is instruction-bound (more/faster cores might be helpful to improve performance).

Furthermore, per CPU the effective number of cycles ('cycl') is shown. This value can reach the current CPU frequency if such CPU is 100% busy ⚡. When an idle CPU is halted, the number of effective cycles can be (considerably) lower than the current frequency. Notice that the average instructions per cycle and number of cycles is shown in the CPU line for all CPUs.

Beware that reading the cycle counter in virtual machines (guests) might introduce performance delays 🐢. Therefore this metric is by default disabled in virtual machines. However, with the keyword 'perfevents' in the atoprc file this metric can be explicitly set to 'enable' or 'disable' (see separate man-page of atoprc). 🙈

Okay so when frequency scaling is in play, all those CPU percentages we just talked about are relative to the scaling the CPU actually used during the interval — no cap. If a CPU was active for e.g. 50% in user mode during the interval while that CPU’s frequency scaling was 40%, then only 20% of the full capacity of the CPU was used in user mode. Math ate, honestly. 💅

If the kernel module cpufreq_stats is active (after issuing modprobe cpufreq_stats), you get the average frequency (avgf) and the average scaling percentage (avgscal). Otherwise you get the current frequency (curf) and the current scaling percentage (curscal) at the exact moment the sample is taken. Notice that average values for frequency and scaling are shown in the CPU line for every CPU. ✨

If the screen-width does not allow all of these counters, only a relevant subset is shown. We love a responsive layout, lowkey.

CPL 💻 — CPU load information

This line is literally the load-average tea: figures reflecting the number of threads that are available to run on a CPU (i.e. part of the runqueue) or that are waiting for disk I/O. These figures are averaged over 1 (avg1), 5 (avg5) and 15 (avg15) minutes. Furthermore, you get the number of context switches (csw), the number of serviced interrupts (intr) and the number of available CPUs. Iconic little line.

If the screen-width does not allow all of these counters, only a relevant subset is shown.

GPU 🎮 — GPU utilization (NVIDIA)

Read the section GPU STATISTICS GATHERING in this document to find the details about the activation of the atopgpud daemon. That’s the lore you need. 🫶

In the first column of every line, the bus-id (last nine characters) and the GPU number are shown. The subsequent columns show:

gpubusy — the percentage of time that one or more kernels were executing on the GPU.
membusy — the percentage of time that global (device) memory was being read or written.
memocc — the occupation percentage of memory.
total — the total memory.
used — the memory being in use at the moment of the sample.
usavg — the average memory being in use during the sample time.
#proc — the number of processes being active on the GPU at the moment of the sample.
the type of GPU.

If the screen-width does not allow all of these counters, only a relevant subset is shown. The number of lines showing the GPUs can be limited. Slay, but make it fit. 💅

MEM 🧠 — memory occupation (two lines)

Two lines, so many counters, here’s the full stack:

tot — the total amount of physical memory.
free — the amount of memory which is currently free.
avail — the amount of memory that is available for new workloads without pushing the system into swap.
cache — the amount of memory in use as page cache including the total resident shared memory.
dirty — the amount of memory within the page cache that has to be flushed to disk.
buff — the amount of memory used for filesystem meta data.
slab — the amount of memory being used for kernel mallocs.
slrec — the amount of slab memory that is reclaimable.
shmem — the resident size of SYSV shared memory including tmpfs but excluding static huge pages.
shrss — the resident size of SYSV shared memory including static huge pages.
shswp — the amount of SYSV shared memory that is currently swapped.
pgtab — the amount of memory that is currently used for page tables.
numnode — the number of NUMA nodes in this system.
vmbal — the amount of memory that is currently claimed by vmware’s balloon driver.
zfarc — the amount of memory that is currently claimed by the ARC (cache) of ZFSonlinux.
anthp — the amount of memory for anonymous transparent huge pages.
hptot — the amount of memory that is claimed for huge pages.
hpuse — the amount of huge page memory that is really in use.
tcps — the amount of memory that is used for TCP sockets.
udps — the amount of memory that is used for UDP sockets.

If the screen-width does not allow all of these counters, only a relevant subset is shown. Bestie, there are so many counters. 😭

SWP 🍓 — swap occupation and overcommit info

This line contains:

tot — the total amount of swap space on disk.
free — the amount of free swap space.
swcac — the size of the swap cache.
zswap — the size of compressed storage used for zswap.
zstor — the real (decompressed) size of the pages stored in zswap.
ksuse — the total size of the memory used for KSM (i.e. shared).
kssav — the total size of the memory saved (deduped) by KSM (i.e. sharing).

Furthermore, the committed virtual memory space (vmcom) and the maximum limit of the committed space (vmlim, which is by default swap size plus 50% of memory size) are shown. The committed space is the reserved virtual space for all allocations of private memory space for processes. The kernel only verifies whether the committed space exceeds the limit if strict overcommit handling is configured (vm.overcommit_memory is 2). Important caveat, bestie — don’t skip that part. 🫶

LLC 🧊 — Last-Level Cache of CPU info

This line contains the total memory bandwidth of LLC (tot), the bandwidth of the local NUMA node (loc), and the percentage of LLC in use (LLCXX YY%).

Note that this feature depends on the resctrl pseudo filesystem. Be sure that the kernel is built with the relevant config and take care that the pseudo-filesystem is mounted:

mount -t resctrl resctrl -o mba_MBps /sys/fs/resctrl (on Intel)
mount -t resctrl resctrl -o cdp      /sys/fs/resctrl (on AMD)

NUM 🧩 — memory utilization per NUMA node (not shown for single NUMA node)

This line shows:

tot — the total amount of physical memory of this node.
free — the amount of free memory.
file — the amount of memory for cached file data.
dirty — modified cached file data.
activ — recently used memory.
inact — less recently used memory.
slab — memory being used for kernel mallocs.
slrec — the amount of slab memory that is reclaimable.
shmem — shared memory including tmpfs.
hptot — total huge pages.
hpuse — used huge pages.
frag — the fragmentation percentage.

NUC ⚡ — CPU utilization per NUMA node (not shown for single NUMA node)

This line shows the utilization percentages of all CPUs related to this NUMA node, categorized for:

sys — system mode.
user — user mode.
niced — user mode for niced processes.
idle — idle mode.
wait mode — w preceded by the node number.
irq — irq mode.
sirq — softirq mode.
steal — steal mode.
guest — guest mode overlapping user mode.

PAG 🌸 — paging frequency

This line contains:

scan — the number of scanned pages due to the fact that free memory drops below a particular threshold.
steal — the number of reclaimed pages due to the fact that free memory drops below a particular threshold.
stall — the number times that the kernel tries to reclaim pages due to an urgent need.
compact — the number of process stalls to run memory compaction to allocate huge pages.
numamig — the number of NUMA pages migrated.
migrate — the total number of memory pages migrated successfully e.g. between NUMA nodes or for compaction.
pgin — the number of memory pages the system read from block devices.
pgout — the number of memory pages the system wrote to block devices.
zswin — the number of memory pages swapped in from zswap.
zswout — the number of memory pages swapped out to zswap.
swin — the number of memory pages the system read from swap space.
swout — the number of memory pages the system wrote to swap space.
oomkill — the number of out-of-memory kills. 💀

PSI 🦋 — Pressure Stall Information

This line contains percentages about resource pressure related to CPU, memory and disk I/O. Certain percentages refer to some, meaning that some processes/threads were delayed due to resource overload. Other percentages refer to full, meaning a loss of overall throughput due to resource overload.

The values cpusome, memsome, memfull, iosome and iofull show the pressure percentage during the entire interval.

The values cs (cpu some), ms (memory some), mf (memory full), is (I/O some) and if (I/O full) each show three percentages separated by slashes: pressure percentage over the last 10, 60 and 300 seconds. The way that slash notation ate is real. 💅

For some Linux distributions PSI support might be disabled by default. In that case you need to pass psi=1 on the kernel command line during boot.

🧮 LVM/MDD/DSK — logical volume/multiple device/disk utilization

Per active unit one line is produced, sorted on unit activity. Such line shows:

the name (e.g. VolGroup00-lvtmp for a logical volume or sda for a hard disk).
busy — the percentage of elapsed time during which I/O requests were issued to the device. Note that for devices serving requests in parallel, such as RAID arrays, SSD and NVMe, this number does not reflect their performance limits.
read — the number of read requests issued.
write — the number of write requests issued.
discrd — the number of discard requests issued, if supported by kernel version.
KiB/r — the number of KiBytes per read.
KiB/w — the number of KiBytes per write.
KiB/d — the number of KiBytes per discard, if supported by kernel version.
MBr/s — the number of MiBytes per second throughput for reads.
MBw/s — the number of MiBytes per second throughput for writes.
inflt — requests issued to the device driver but not completed.
avq — the average queue depth while busy.
avio — the average number of milliseconds needed by a request for seek, latency and data transfer.

If the screen-width does not allow all of these counters, only a relevant subset is shown.

The number of lines showing the units can be limited per class (LVM, MDD or DSK) with the l key or statically (see separate man-page of atoprc). By specifying the value 0 for a particular class, no lines will be shown any more for that class. Periodt. 👑

NFM — Network Filesystem (NFS) mount at the client side. For each NFS-mounted filesystem, you get one line, bestie, and it shows the mounted server directory, the name of the server ('srv'), the total number of bytes physically read from the server ('read') and the total number of bytes physically written to the server ('write'). The data transfer is broken down into the number of bytes read via normal read() system calls ('nread'), the number of bytes written via normal write() system calls ('nwrit'), the number of bytes read via direct I/O ('dread'), the number of bytes written via direct I/O ('dwrit'), the number of bytes read via page cache read-ahead pages ('mread'), and the number of bytes written via page cache write-back pages ('mwrit'), i.e. asynchronous flushes. That's a lot of little counters, but they all matter.

NFC — Network Filesystem (NFS) client side counters. This line has the number of RPC calls issued by local processes ('rpc'), the number of read RPC calls ('read') and write RPC calls ('rpwrite') issued to the NFS server, the number of RPC calls being retransmitted ('retxmit') and the number of authorization refreshes ('autref'). Client-side receipts, basically.

NFS — Network Filesystem (NFS) server side counters. This line has the number of RPC calls received from NFS clients ('rpc'), the number of read RPC calls received ('cread'), the number of write RPC calls received ('cwrit'), the number of Megabytes/second returned to read requests by clients ('MBcr/s'), the number of Megabytes/second passed in write requests by clients ('MBcw/s'), the number of network requests handled via TCP ('nettcp'), the number of network requests handled via UDP ('netudp'), the number of reply cache hits ('rchits'), the number of reply cache misses ('rcmiss') and the number of uncached requests ('rcnoca'). Furthermore there are some error counters indicating the number of requests with a bad format ('badfmt') or a bad authorization ('badaut'), and a counter indicating the number of bad clients ('badcln'). Server said “here's the whole vibe check,” and this is it.

NET — Network utilization (TCP/IP). One line is shown for activity of the transport layer (TCP and UDP), one line for the IP layer, and one line per active interface. For the transport layer, the counters shown are about the number of received TCP segments including those received in error ('tcpi'), the number of transmitted TCP segments excluding those containing only retransmitted octets ('tcpo'), the number of UDP datagrams received ('udpi'), the number of UDP datagrams transmitted ('udpo'), the number of active TCP opens ('tcpao'), the number of passive TCP opens ('tcppo'), the number of TCP output retransmissions ('tcprs'), the number of TCP input errors ('tcpie'), the number of TCP output resets ('tcpor'), the number of UDP no ports ('udpnp'), the number of UDP input errors ('udpie'), and the number of TCP incorrect checksums ('csumie'). If the screen-width does not allow all of these counters, only a relevant subset is shown. These counters are related to IPv4 and IPv6 combined. Combined! Equality! We love to see it.

For the IP layer, the counters shown are about the number of IP datagrams received from interfaces, including those received in error ('ipi'), the number of IP datagrams that local higher-layer protocols offered for transmission ('ipo'), the number of received IP datagrams which were forwarded to other interfaces ('ipfrw'), the number of IP datagrams which were delivered to local higher-layer protocols ('deliv'), the number of received ICMP datagrams ('icmpi'), and the number of transmitted ICMP datagrams ('icmpo'). If the screen-width does not allow all of these counters, only a relevant subset is shown. These counters are related to IPv4 and IPv6 combined.

For every active network interface, one line is shown, sorted on the interface activity. Such a line shows the name of the interface and its busy percentage in the first column. The busy percentage for half duplex is determined by comparing the interface speed with the number of bits transmitted and received per second; for full duplex the interface speed is compared with the highest of either the transmitted or the received bits. When the interface speed can not be determined (e.g. for the loopback interface), '---' is shown instead of the percentage. Furthermore it shows the number of received packets ('pcki'), the number of transmitted packets ('pcko'), the line speed of the interface ('sp'), the effective amount of bits received per second ('si'), the effective amount of bits transmitted per second ('so'), the number of collisions ('coll'), the number of received multicast packets ('mlti'), the number of errors while receiving a packet ('erri'), the number of errors while transmitting a packet ('erro'), the number of received packets dropped ('drpi'), and the number of transmitted packets dropped ('drpo'). If the screen-width does not allow all of these counters, only a relevant subset is shown. The number of lines showing the network interfaces can be limited. Interface lines understood: your network is doing cardio and we're watching.

IFB — Infiniband utilization. For every active Infiniband port, one line is shown, sorted on activity. Such a line shows the name of the port and its busy percentage in the first column. The busy percentage is determined by taking the highest of either the transmitted or the received bits during the interval, multiplying that value by the number of lanes, and comparing it against the maximum port speed. Furthermore it shows the number of received packets divided by the number of lanes ('pcki'), the number of transmitted packets divided by the number of lanes ('pcko'), the maximum line speed ('sp'), the effective amount of bits received per second ('si'), the effective amount of bits transmitted per second ('so'), and the number of lanes ('lanes'). If the screen-width does not allow all of these counters, only a relevant subset is shown. The number of lines showing the Infiniband ports can be limited. Lanes divided packets? It's giving very specific math and honestly? Respect.

💖 OUTPUT DESCRIPTION - CGROUPS LEVEL (V2) 💖

In the bottom part of the screen, a hierarchical list of cgroups can be shown. By default, cgroups without assigned processes in the cgroup itself and the cgroups underneath will be suppressed. By pressing the 'a' key (toggle) all cgroups will be shown. Toggle queen behavior.

When depth level '8' or '9' has been selected (by pressing the corresponding key) the assigned processes are shown as well. By default, only the processes that were active during the interval. By pressing the 'a' key (toggle) all processes will be shown.

Per cgroup the following fields may be shown (in alphabetical order), depending on the current width of your window:

CGROUP — Name of the cgroup (version 2), i.e. the directory name in the cgroup hierarchy. This root cgroup '/' corresponds to the cgroup root directory, which is usually '/sys/fs/cgroup'.
CPUBUSY — The consumed CPU percentage by this cgroup and all cgroups underneath (as a percentage of one CPU). Value -1 means undefined.
CPUMAX — The 'cpu.max' value of this cgroup (version 2), calculated as percentage of one CPU. Value -1 means maximum, while value -2 means undefined.
CPUPS — The CPU pressure percentage ('some') in this cgroup and cgroups underneath. For some Linux distributions PSI support might be disabled by default. In that case you need to pass psi=1 on the kernel command line during boot.
CPUWGT — The 'cpu.weight' value of this cgroup (version 2). Value -2 means undefined.
DISKIO — The amount of data transferred to/from physical disks in this cgroup and the cgroups underneath. Value -1 means undefined.
DSKPS — The disk pressure percentage ('full') in this cgroup and cgroups underneath. For some Linux distributions PSI support might be disabled by default. In that case you need to pass psi=1 on the kernel command line during boot.
IOWGT — The 'io.weight' value of this cgroup (version 2). Value -2 means undefined.
MEMMAX — The 'memory.max' value of this cgroup (version 2). Value -1 means maximum, while value -2 means undefined.
MEMORY — The current memory occupation ('memory.current' value) of this cgroup and all cgroups underneath. Value -1 means undefined.

Notice that the memory occupation of a cgroup implies all memory pages that are first referenced (faulted in) from such cgroup. So apart from resident process pages, the cgroup memory includes all page cache pages, slab cache pages, tmpfs pages and shared memory pages that are first referenced by a process in this cgroup.

This means that the cgroup memory might be much higher than the cumulated memory consumption (RSS) of the processes in the cgroup (shown after pressing the key '8' or '9'). However, the cgroup memory might also be lower than the cumulated memory consumption of the processes in the cgroup, when these processes share code pages, shared library pages, shared memory pages or mmapped pages that have been assigned (i.e. first referenced) by processes in other cgroups. Memory accounting is complicated, bestie. Don't start drama between cgroups.

MEMPS — The memory pressure percentage ('full') in this cgroup and cgroups underneath. For some Linux distributions PSI support might be disabled by default. In that case you need to pass psi=1 on the kernel command line during boot.
NPROCS — The number of processes assigned to this cgroup.
PBELOW — The number of processes assigned to the cgroups underneath this cgroup.
SWPMAX — The 'memory.swap.max' value of this cgroup (version 2). Value -1 means maximum, while value -2 means undefined.

🦋 OUTPUT DESCRIPTION - PROCESS LEVEL 🦋

In the bottom part of the screen, a list of processes can be shown from which the resource utilization has changed during the last interval. These processes might have used CPU time or might have issued disk or network requests. However a process is also shown if part of it has been paged out due to lack of memory (while the process itself was in sleep state). Sleeping but still relevant? Relatable.

Per process the following fields may be shown (in alphabetical order), depending on the current output mode as described in the section INTERACTIVE COMMANDS and depending on the current width of your window:

AVGRSZ — The average size of one read-action on disk.
AVGWSZ — The average size of one write-action on disk.

okay bestie, still deep in the process-level field list and we're not stopping, because every single one of these columns matters. 💅

BANDWI — the total bandwidth for received TCP and UDP packets that this process ate up, in bits-per-second. You can compare it with the value 'si' on interface level (that's used bandwidth per interface) ✨. This info only shows up when the optional module netatop or netatop-bpf is loaded.
BANDWO — same vibe but for sent TCP and UDP packets, again bits-per-second. Compare this one with the value 'so' on interface level (used bandwidth per interface). Also only shown when the optional module netatop or netatop-bpf is loaded, no cap.
BDELAY — aggregated block I/O delay, meaning the time spent waiting for disk I/O 😭. Heads up though: on modern kernels this value is only maintained when the kernel parameter /proc/sys/kernel/task_delayacct is set to 1 (and you can manage that by setting kernel.task_delayacct=1 with the sysctl command). Otherwise? This value is literally always zero, every time.
CID/POD — the container id (think Docker or Podman) or pod name (think Kubernetes) referring to the container/pod that this process/thread is running inside 📦. When a pod name is longer than 15 characters, only the last 15 characters get shown.
- If a process got started and finished during the last interval, a '?' is shown, because the container id or pod name is not part of the standard process accounting record.
- This column only shows up when atop runs with superuser privileges and at least one containerized process is detected.
CMD — the name of the process 🏷️. This name can be surrounded by "less/greater than" signs ('<name>'), which means the process finished during the last interval. A single accounting record is written for the entire process on termination of the last thread in the process. When the main thread exits, the process name gets changed to the thread name. Behind the abbreviation CMD in the header line, the current page number and the total number of pages of the process/thread list are shown — so you always know where you are, iykyk.
COMMAND-LINE — the full command line of the process, arguments included 🫶. If the command line is longer than the screen line, you can use the arrow keys -> and <- to horizontally scroll.
- The -z <regex> command line option can be used to prepend matching environment variables to the displayed command line. POSIX Extended Regular Expression syntax is used (see regex(3)). When a matching environment variable is too long (like, exceeding the buffer that should contain the command line), it will be truncated.
- Usually only the environment variables of processes running under your own user ID get shown, unless you're a privileged user.
- Behind the verb COMMAND-LINE in the header line, the current page number and total number of pages of the process/thread list are shown too.

⚠️ WARNING: don't use this flag when writing to a (publicly readable) raw file! You might expose sensitive environment variables to the readers of that raw file. That's giving data leak energy and we are NOT here for it. 🙈

CPU — the occupation percentage of this process, relative to the available capacity for this resource on system level 🔥.
CPUNR — the identification of the CPU that the (main) thread is running on, or has recently been running on.
CTID — the container ID (OpenVZ). If a process was started and finished during the last interval, a '?' is shown, because the container ID is not part of the standard process accounting record.
DSK — the occupation percentage of this process relative to the total load produced by all processes (i.e. total disk accesses by all processes during the last interval) 💾. This info shows up when per-process "storage accounting" is active in the kernel.
EGID — the effective group-id under which this process executes. When the name is longer than 8, or when the -I flag is used, the number is shown instead of the name. However, when the -i flag is used, the full group name will be shown ✨.
ENDATE — the date that the process finished. If the process is still running, this field shows 'active'.
ENTIME — the time that the process finished. If the process is still running, this field shows 'active'.
ENVID — the virtual environment identified (OpenVZ only).
EUID — the effective user-id under which this process executes. When the name is longer than 8, or when the -I flag is used, the number is shown instead of the name. But when the -i flag is used, the full user name will be shown 👑
EXC — the exit code of a terminated process (that's when the second position of column 'ST' is E), or the fatal signal number (when the second position of column 'ST' is S or C) 💀.
FSGID — the filesystem group-id under which this process executes. When the name is longer than 8, or when the -I flag is used, the number is shown instead of the name.
FSUID — the filesystem user-id under which this process executes. When the name is longer than 8, or when the -I flag is used, the number is shown instead of the name.
GPU — the GPU percentage reflects the GPU busy percentage 🎮.
GPUBUSY — busy percentage on all GPUs (one GPU is 100%).
GPUNUMS — a comma-separated list of the GPUs used by the process during the interval. When that comma-separated list exceeds the width of the column, a hexadecimal value is shown instead.
LOCKSZ — the virtual amount of memory being locked (i.e. non-swappable) by this process (or user) 🔒.
MAJFLT — the number of page faults issued by this process that were solved by creating/loading the requested memory page.
MEM — the occupation percentage of this process relative to the available capacity for this resource on system level 🌸.
MEMAVG — average memory occupation during the interval on all used GPUs.
MEMBUSY — busy percentage of memory on all GPUs (one GPU is 100%), i.e. the time needed for read and write accesses on memory.
MEMNOW — memory occupation at the moment of the sample on all used GPUs.
MINFLT — the number of page faults issued by this process that were solved by reclaiming the requested memory page from the free list of pages.
NET — the occupation percentage of this process relative to the total load produced by all processes (i.e. consumed network bandwidth of all processes during the last interval) 🌐. Again, this info only shows up when the optional module netatop or netatop-bpf is loaded.
NICE — the more-or-less static priority that can be given to a process, on a scale from -20 (high priority) to +19 (low priority).
NIVCSW — number of times the process/thread was context-switched involuntarily, in the case that the time slice expired.
NPROCS — the number of active and terminated processes accumulated for this user or program.
NVCSW — number of times the process/thread was context-switched voluntarily, in the case of a blocking system call, e.g. waiting for an I/O operation to complete.
OOMADJ — the value that adjusts the OOM score value of this process (usually 2/3 of this value is taken for adjustment), in a range from -1000 till +1000. Value -1000 means the process will never be killed due to OOM killing — it's literally immortal, main character energy 👑.
OOMSC — the Out-Of-Memory (OOM) score of this process, in a range from 0 till 2000. The higher this value, the more likely this process gets killed when the system runs out of memory (and swap space) 💀.
PID — process-id. If a process was started and finished during the last interval, a '?' is shown, because the process-id is not part of the standard process accounting record.
POLI — the policies 'norm' (normal, which is SCHED_OTHER), 'btch' (batch) and 'idle' refer to timesharing processes. The policies 'fifo' (SCHED_FIFO) and 'rr' (round robin, which is SCHED_RR) refer to realtime processes ⚡.
PPID — parent process-id. If a process was started and finished during the last interval, value 0 is shown, because the parent process-id is not part of the standard process accounting record.
PRI — the process' priority ranges from 0 (highest priority) to 139 (lowest priority). Priority 0 to 99 are used for realtime processes (fixed priority independent of their behavior) and priority 100 to 139 for timesharing processes (variable priority depending on their recent CPU consumption and the nice value).
PSIZE — the proportional memory size of this process (or user) 🧠. Every process shares resident memory with other processes — like, when a particular program is started several times, the code pages (text) are only loaded once in memory and shared by all incarnations. Also the code of shared libraries is shared by all processes using that shared library, as well as shared memory and memory-mapped files. For the PSIZE calculation of a process, the resident memory of a process that is shared with other processes is divided by the number of sharers. This means every process is accounted for a proportional part of that memory. Accumulating the PSIZE values of all processes in the system gives a reliable impression of the total resident memory consumed by all processes — iconic, honestly.
- Since gathering all the values needed to calculate PSIZE is a very time-consuming task, the 'R' key (or -R flag) should be active. Gathering these values also requires superuser privileges (otherwise '?K' is shown in the output).
- If a process has finished during the last interval, no value is shown, since the proportional memory size is not part of the standard process accounting record.
RDDSK — the read data transfer actually issued physically on disk (so like, reading from the disk cache does not count here, bestie). Unfortunately, the kernel aggregates the data transfer of a process into the data transfer of its parent process when it terminates. So you might see transfers for (parent) processes like bash or systemd that were not really issued by them but by their terminated child processes. 😭
RDELAY — runqueue delay, i.e. time spent waiting on a runqueue. 💤
RGID — the real group-id under which the process executes. When the name is longer than 8 or when the -I flag is used, the number is shown instead of the name. However, when the -i flag is used, the full group name will be shown. 💅
RGROW — the amount of resident memory that the process has grown during the last interval. A resident growth can be caused by touching memory pages which were not physically created/loaded before (load-on-demand). Note that a resident growth can also be negative, e.g. when part of the process is paged out due to lack of memory or when the process frees dynamically allocated memory. For a process which started during the last interval, the resident growth reflects the total resident size of the process at that moment. If a process has finished during the last interval, no value is shown since resident memory occupation is not part of the standard process accounting record. 🫠
RNET — the number of TCP- and UDP packets received by this process. This information will only be shown when the optional module netatop or netatop-bpf is installed. 🦋 If a process has finished during the last interval, no value is shown since network counters are not part of the standard process accounting record.
RSIZE — the total resident memory usage consumed by this process (or user). Notice that the RSIZE of a process includes all resident memory used by that process, even if certain memory parts are shared with other processes (see also the explanation of PSIZE). 👑 If a process has finished during the last interval, no value is shown since resident memory occupation is not part of the standard process accounting record.
RTPR — realtime priority according the POSIX standard. Value can be 0 for a timesharing process (policy 'norm', 'btch' or 'idle') or ranges from 1 (lowest) till 99 (highest) for a realtime process (policy 'rr' or 'fifo'). ⚡
RUID — the real user-id under which the process executes. When the name is longer than 8 or when the -I flag is used, the number is shown instead of the name. However, when the -i flag is used, the full user name will be shown. 💖
S — the current state of the (main) thread: 'R' for running (currently processing or in the runqueue), 'S' for sleeping interruptible (wait for an event to occur), 'D' for sleeping non-interruptible, 'Z' for zombie (waiting to be synchronized with its parent process), 'T' for stopped (suspended or traced), 'W' for swapping, and 'E' (exit) for processes which have finished during the last interval. 🧟
SGID — the saved group-id of the process. When the name is longer than 8 or when the -I flag is used, the number is shown instead of the name. ✨
SNET — the number of TCP and UDP packets transmitted by this process. This information will only be shown when the optional module netatop or netatop-bpf is installed. 🦋
ST — the status of a process. 👀 The first position indicates if the process has been started during the last interval (the value N means 'new process'). The second position indicates if the process has been finished during the last interval. The value E means 'exit' on the process' own initiative; the exit code is displayed in the column 'EXC'. The value S means that the process has been terminated unvoluntarily by a signal; the signal number is displayed in the in the column 'EXC'. The value C means that the process has been terminated unvoluntarily by a signal, producing a core dump in its current directory; the signal number is displayed in the column 'EXC'. 💀
STDATE — the start date of the process. 📅
STTIME — the start time of the process. ⏰
SUID — the saved user-id of the process. When the name is longer than 8 or when the -I flag is used, the number is shown instead of the name. 🌸
SWAPSZ — the swap space consumed by this process (or user). 🌀
SYSCPU — CPU time consumption of this process in system mode (kernel mode), usually due to system call handling. 🔥
TCPRASZ — the average size of a received TCP buffer in bytes. This information will only be shown when the optional module netatop or netatop-bpf is installed. 🎀
TCPRCV — the number of TCP packets received for this process. This information will only be shown when the optional module netatop or netatop-bpf is installed. 📥
TCPSASZ — the average size of a transmitted TCP buffer in bytes. This information will only be shown when the optional module netatop or netatop-bpf is installed. 🎀
TCPSND — the number of TCP packets transmitted for this process. This information will only be shown when the optional module netatop or netatop-bpf is installed. 📤
THR — total number of threads within this process. All related threads are contained in a thread group, represented by atop as one line or as a separate line when the 'y' key (or -y flag) is active. 🧵 On Linux 2.4 systems it is hardly possible to determine which threads (i.e. processes) are related to the same thread group. Every thread is represented by atop as a separate line. 🦕
TID — thread-id. All threads within a process run with the same PID but with a different TID. This value is shown for individual threads in multi-threaded processes (when using the key 'y'). 💅
TIDLE — number of threads within this process that are in the state 'idle' (I), i.e. uninterruptible sleeping threads that do not count for the load average. 😴
TRUN — number of threads within this process that are in the state 'running' (R). 🏃‍♀️
TSLPI — number of threads within this process that are in the state 'interruptible sleeping' (S). 💤
TSLPU — number of threads within this process that are in the state 'uninterruptible sleeping' (D). 😶‍🌫️
UDPRASZ — the average size of a received UDP packet in bytes. This information will only be shown when the optional module netatop or netatop-bpf is installed. 🎀
UDPRCV — the number of UDP packets received by this process. This information will only be shown when the optional module netatop or netatop-bpf is installed. 📥
UDPSASZ — the average size of a transmitted UDP packets in bytes. This information will only be shown when the optional module netatop or netatop-bpf is installed. 🎀
UDPSND — the number of UDP packets transmitted by this process. This information will only be shown when the optional module netatop or netatop-bpf is installed. 📤
USRCPU — CPU time consumption of this process in user mode, due to processing the own program text. 🔥
VDATA — the virtual memory size of the private data used by this process (including heap and shared library data). 🗂️
VGROW — the amount of virtual memory that the process has grown during the last interval. A virtual growth can be caused by e.g. issuing a malloc() or attaching a shared memory segment. Note that a virtual growth can also be negative by e.g. issuing a free() or detaching a shared memory segment. For a process which started during the last interval, the virtual growth reflects the total virtual size of the process at that moment. If a process has finished during the last interval, no value is shown since virtual memory occupation is not part of the standard process accounting record. 🫠
VPID — virtual process-id (within an OpenVZ container). If a process has been started and finished during the last interval, a '?' is shown because the virtual process-id is not part of the standard process accounting record. 📦
VSIZE — the total virtual memory usage consumed by this process (or user). 👑 If a process has finished during the last interval, no value is shown since virtual memory occupation is not part of the standard process accounting record.
VSLIBS — the virtual memory size of the (shared) text of all shared libraries used by this process. 📚
VSTACK — the virtual memory size of the (private) stack used by this process. 🥞
VSTEXT — the virtual memory size of the (shared) text of the executable program. 📜
WCHAN — wait channel of thread in sleep state, i.e. the name of the kernel function in which the thread has been put asleep. 😴 Since determining the name string of the kernel function is a relatively time-consuming task, the 'W' key (or '-W' flag) should be active. ⚠️
WRDSK — the write data transfer issued physically on disk (so writing to the disk cache is not accounted for). This counter is maintained for the application process that writes its data to the cache (assuming that this data is physically transferred to disk later on). Notice that disk I/O needed for swapping is not taken into account. 💾 Unfortunately, the kernel aggregates the data transfer of a process to the data transfer of its parent process when terminating. So you might see transfers for (parent) processes like bash or systemd that are not really issued by them but by their terminated child processes. 😭
WCANCL — the write data transfer previously accounted for this process or another process that has been cancelled. Suppose that a process writes new data to a file and that data is removed again before the cache buffers have been flushed to disk. Then the original process shows the written data as WRDSK, while the process that removes/truncates the file shows the unflushed removed data as WCANCL. 🗑️✨

✨ PARSABLE OUTPUT ✨

Okay bestie, if you want output that a script can actually digest instead of the interactive glow-up, this is the mode. 💖 With the flag -P followed by a list of one or more labels (comma-separated), parsable output is produced for each sample.

The labels that can be specified for system-level statistics correspond to the labels (first verb of each line) that can be found in the interactive output: CPU, cpu, CPL, GPU, MEM, SWP, PAG, PSI, LVM, MDD, DSK, NFM, NFC, NFS, NET, IFB, LLC, NUM and NUC.

For cgroup-level statistics the label CGR is available.

For process-level statistics special labels are available: PRG (general), PRC (CPU), PRE (GPU), PRM (memory), PRD (disk, but requires special privileges) and PRN (network, only if the optional module netatop or netatop-bpf is installed). With the label ALL, all system and process level statistics are shown.

The command and command line in the parsable output might contain spaces and are therefore by default surrounded by parenthesis. However, since a space is often used as separator between the fields by parsing tools, with the additional flag -Z it is possible to exchange the spaces in the command (line) by underscores and omit the parenthesis.

For every interval all requested lines are shown whereafter atop shows a line just containing the label SEP as a separator before the lines for the next sample are generated. When a sample contains the values since boot, atop shows a line just containing the label RESET before the lines for this sample are generated.

The first part of each output-line consists of the following six fields:

label — the name of the label
host — the name of this machine
epoch — the time of this interval as number of seconds since 1-1-1970
date — date of this interval in format YYYY/MM/DD
time — time of this interval in format HH:MM:SS
interval — number of seconds elapsed for this interval

The subsequent fields of each output-line depend on the label:

CPU — Subsequent fields: total number of clock-ticks per second for this machine, number of processors, consumption for all CPUs in system mode (clock-ticks), consumption for all CPUs in user mode (clock-ticks), consumption for all CPUs in user mode for niced processes (clock-ticks), consumption for all CPUs in idle mode (clock-ticks), consumption for all CPUs in wait mode (clock-ticks), consumption for all CPUs in irq mode (clock-ticks), consumption for all CPUs in softirq mode (clock-ticks), consumption for all CPUs in steal mode (clock-ticks), consumption for all CPUs in guest mode (clock-ticks) overlapping user mode, frequency of all CPUs (MHz), frequency percentage of all CPUs, instructions executed by all CPUs and cycles for all CPUs.
cpu — Subsequent fields: total number of clock-ticks per second for this machine, processor-number, consumption for this CPU in system mode (clock-ticks), consumption for this CPU in user mode (clock-ticks), consumption for this CPU in user mode for niced processes (clock-ticks), consumption for this CPU in idle mode (clock-ticks), consumption for this CPU in wait mode (clock-ticks), consumption for this CPU in irq mode (clock-ticks), consumption for this CPU in softirq mode (clock-ticks), consumption for this CPU in steal mode (clock-ticks), consumption for this CPU in guest mode (clock-ticks) overlapping user mode, frequency of this CPU (Mhz), frequency percentage of this CPU, instructions executed by this CPU and cycles for this CPU.
CPL — Subsequent fields: number of processors, load average for last minute, load average for last five minutes, load average for last fifteen minutes, number of context-switches, and number of device interrupts.
GPU — Subsequent fields: GPU number, bus-id string, type of GPU string, GPU busy percentage during last second (-1 if not available), memory busy percentage during last second (-1 if not available), total memory size (KiB), used memory (KiB) at this moment, number of samples taken during interval, cumulative GPU busy percentage during the interval (to be divided by the number of samples for the average busy percentage, -1 if not available), cumulative memory busy percentage during the interval (to be divided by the number of samples for the average busy percentage, -1 if not available), and cumulative memory occupation during the interval (to be divided by the number of samples for the average occupation).
MEM — Subsequent fields: page size for this machine (in bytes), size of physical memory (pages), size of free memory (pages), size of page cache (pages), size of buffer cache (pages), size of slab (pages), dirty pages in cache (pages), reclaimable part of slab (pages), total size of vmware's balloon pages (pages), total size of shared memory (pages), size of resident shared memory (pages), size of swapped shared memory (pages), smaller huge page size (in bytes), total size of smaller huge pages (huge pages), size of free smaller huge pages (huge pages), size of ARC (cache) of ZFSonlinux (pages), size of sharing pages for KSM (pages), size of shared pages for KSM (pages), size of memory used for TCP sockets (pages), size of memory used for UDP sockets (pages), size of pagetables (pages), larger huge page size (in bytes), total size of larger huge pages (huge pages), size of free larger huge pages (huge pages), size of available memory (pages) for new workloads without swapping, and size of anonymous transparent huge pages ('normal' pages).
SWP — Subsequent fields: page size for this machine (in bytes), size of swap (pages), size of free swap (pages), size of swap cache (pages), size of committed space (pages), limit for committed space (pages), size of the swap cache (pages), the real (decompressed) size of the pages stored in zswap (pages), and the size of compressed storage used for zswap (pages).
LLC — Subsequent fields: LLC id, percentage of LLC in use, total memory bandwidth of this LLC (in bytes), and memory bandwidth on local NUMA node of this LLC (in bytes).
PAG — Subsequent fields: page size for this machine (in bytes), number of page scans, number of allocstalls, 0 (future use), number of swapins, number of swapouts, number of oomkills (-1 when counter not present), number of process stalls to run memory compaction, number of pages successfully migrated in total, number of NUMA pages migrated, number of pages read from block devices, number of pages written to block devices, number of swapins from zswap, and number of swapouts to zswap.
PSI — Subsequent fields: PSI statistics present on this system (n or y), CPU some avg10, CPU some avg60, CPU some avg300, CPU some accumulated microseconds during interval, memory some avg10, memory some avg60, memory some avg300, memory some accumulated microseconds during interval, memory full avg10, memory full avg60, memory full avg300, memory full accumulated microseconds during interval, I/O some avg10, I/O some avg60, I/O some avg300, I/O some accumulated microseconds during interval, I/O full avg10, I/O full avg60, I/O full avg300, and I/O full accumulated microseconds during interval.
LVM/MDD/DSK — For every logical volume/multiple device/hard disk one line is shown. Subsequent fields: name, number of milliseconds spent for I/O, number of reads issued, number of sectors transferred for reads, number of writes issued, number of sectors transferred for write, number of discards issued (-1 if not supported), number of sectors transferred for discards, number of requests currently in flight (not yet completed), and the average queue depth while the disk was busy.
NFM — Subsequent fields: mounted NFS filesystem, total number of bytes read, total number of bytes written, number of bytes read by normal system calls, number of bytes written by normal system calls, number of bytes read by direct I/O, number of bytes written by direct I/O, number of pages read for page cache read-ahead, and number of pages written for page cache write-back (asynchronous flushes).
NFC — Subsequent fields: number of transmitted RPCs, number of transmitted read RPCs, number of transmitted write RPCs, number of RPC retransmissions, and number of authorization refreshes.
NFS — Subsequent fields: number of handled RPCs, number of received read RPCs, number of received write RPCs, number of bytes read by clients, number of bytes written by clients, number of RPCs with bad format, number of RPCs with bad authorization, number of RPCs from bad client, total number of handled network requests, number of handled network requests via TCP, number of handled network requests via UDP, number of handled TCP connections, number of hits on reply cache, number of misses on reply cache, and number of uncached requests.
NET — First, one line is produced for the upper layers of the TCP/IP stack. Subsequent fields: the verb "upper", number of packets received by TCP, number of packets transmitted by TCP, number of packets received by UDP, number of packets transmitted by UDP, number of packets received by IP, number of packets transmitted by IP, number of packets delivered to higher layers by IP, number of packets forwarded by IP, number of input errors (UDP), number of noport errors (UDP), number of active opens (TCP), number of passive opens (TCP), number of established connections at this moment (TCP), number of retransmitted segments (TCP), number of input errors (TCP), number of output resets (TCP), and number of checksum errors on received packets (TCP).

okay so next up: for every interface you get exactly one line 👀 and here's everything crammed into it, field by field, in order:

name of the interface
number of packets received by the interface
number of bytes received by the interface
number of packets transmitted by the interface
number of bytes transmitted by the interface
interface speed
duplex mode (0=half, 1=full)
receive errors
transmit errors
receive drops
transmit drops
receive fifo
transmit fifo
receive compressed
transmit compressed
receive framing errors
receive multicast
transmit collisions
transmit carrier

🦋 IFB

InfiniBand girlies rise 💅 it's the same deal, one record with these fields:

name of the InfiniBand interface
port number
number of lanes
maximum rate (Mbps)
number of bytes received
number of bytes transmitted
number of packets received
number of packets transmitted

🌸 NUM

Per NUMA node, bestie — and it is stacked with fields:

NUMA node number
page size for this machine (in bytes)
the fragmentation percentage of this node
size of physical memory (pages)
size of free memory (pages)
recently (active) used memory (pages)
less recently (inactive) used memory (pages)
size of cached file data (pages)
dirty pages in cache (pages)
slab memory being used for kernel mallocs (pages)
slab memory that is reclaimable (pages)
shared memory including tmpfs (pages)
total huge pages (huge pages)
free huge pages (huge pages)

⭐ NUC

NUMA node CPU consumption, no cap 🔥 fields go like this:

NUMA node number
number of processors for this node
consumption for node CPUs in system mode (clock-ticks)
consumption for node CPUs in user mode (clock-ticks)
consumption for node CPUs in user mode for niced processes (clock-ticks)
consumption for node CPUs in idle mode (clock-ticks)
consumption for node CPUs in wait mode (clock-ticks)
consumption for node CPUs in irq mode (clock-ticks)
consumption for node CPUs in softirq mode (clock-ticks)
consumption for node CPUs in steal mode (clock-ticks)
consumption for node CPUs in guest mode (clock-ticks) overlapping user mode

🎀 CGR

For every cgroup (level) you get one or two lines, and the duality of it honestly. The first line is the utilization + configuration line for the cgroup. The optional second line is where the PIDs of the processes assigned to that cgroup show up 🫶

First line fields, in order:

character 'C'
full path name of cgroup
number of processes assigned to this group
number of processes assigned to the cgroups underneath
CPU usage in user mode (microseconds)
CPU usage in system mode (microseconds)
CPU weight
CPU max
current memory usage (pages)
anonymous memory usage (pages)
file memory usage (pages)
kernel memory usage (pages)
shared memory usage (pages)
memory max (pages)
swap max (pages)
number of bytes read from disk
number of bytes written to disk
number of read requests from disk
number of write requests to disk
the disk weight
cpu some pressure (microseconds)
cpu total pressure (microseconds)
memory some pressure (microseconds)
memory total pressure (microseconds)
disk some pressure (microseconds)
disk total pressure (microseconds)

Second line fields — and note this line only shows up when there actually are processes assigned to this cgroup:

character 'P'
full path name of cgroup
list of PIDs separated by spaces

👑 PRG

One line per process, general info edition. Fields:

PID (unique ID of task)
name (between parenthesis or underscores for spaces)
state
real uid
real gid
TGID (group number of related tasks/threads)
total number of threads
exit code (in case of fatal signal: signal number + 256)
start time (epoch)
full command line (between parenthesis or underscores for spaces)
PPID
number of threads in state 'running' (R)
number of threads in state 'interruptible sleeping' (S)
number of threads in state 'uninterruptible sleeping' (D)
effective uid
effective gid
saved uid
saved gid
filesystem uid
filesystem gid
elapsed time of terminated process (hertz)
is_process (y/n)
OpenVZ virtual pid (VPID)
OpenVZ container id (CTID)
container/pod name (CID/POD)
indication if the task is newly started during this interval ('N')
cgroup v2 path name (between parenthesis or underscores for spaces)
end time (epoch or 0 if still active)
number of threads in state 'idle' (I)

🔥 PRC

One line per process again, this time cpu-central ✨

PID
name (between parenthesis or underscores for spaces)
state
total number of clock-ticks per second for this machine
CPU-consumption in user mode (clockticks)
CPU-consumption in system mode (clockticks)
nice value
priority
realtime priority
scheduling policy
current CPU (-1 for exited process)
sleep average
TGID (group number of related tasks/threads)
is_process (y/n)
runqueue delay in nanoseconds for this thread or for all threads (in case of process)
wait channel of this thread (between parenthesis or underscores for spaces)
block I/O delay (clockticks)
cgroup v2 'cpu.max' calculated as percentage (-3 means no cgroup v2 support, -2 means undefined and -1 means maximum)
cgroup v2 most restrictive 'cpu.max' in upper directories calculated as percentage (-3 means no cgroup v2 support, -2 means undefined and -1 means maximum)
number of voluntary context switches
number of involuntary context switches

🌈 PRE

One line per process, but make it GPU 💅

PID
name (between parenthesis or underscores for spaces)
process state
GPU state (A for active, E for exited, N for no GPU user)
number of GPUs used by this process
bitlist reflecting used GPUs
GPU busy percentage during interval
memory busy percentage during interval
memory occupation (KiB) at this moment cumulative memory occupation (KiB) during interval
number of samples taken during interval
is_process (y/n)
type of process (C for computing, G for graphics and U for unknown)

🍓 PRM

One line per process, memory girl summer 🧚

PID
name (between parenthesis or underscores for spaces)
state
page size for this machine (in bytes)
virtual memory size (KiB)
resident memory size (KiB)
shared text memory size (KiB)
virtual memory growth (KiB)
resident memory growth (KiB)
number of minor page faults
number of major page faults
virtual library exec size (KiB)
virtual data size (KiB)
virtual stack size (KiB)
swap space used (KiB)
TGID (group number of related tasks/threads)
is_process (y/n)
proportional set size (KiB) if in 'R' option is specified
virtually locked memory space (KiB)
cgroup v2 'memory.max' in KiB (-3 means no cgroup v2 support, -2 means undefined and -1 means maximum)
cgroup v2 most restrictive 'memory.max' in upper directories in KiB (-3 means no cgroup v2 support, -2 means undefined and -1 means maximum)
cgroup v2 'memory.swap.max' in KiB (-3 means no cgroup v2 support, -2 means undefined and -1 means maximum)
cgroup v2 most restrictive 'memory.swap.max' in upper directories in KiB (-3 means no cgroup v2 support, -2 means undefined and -1 means maximum)

💀 PRD

One line per process, disk-flavored 🎀

PID
name (between parenthesis or underscores for spaces)
state
obsoleted kernel patch installed ('n')
standard io statistics used ('y' or 'n')
number of reads on disk
cumulative number of sectors read
number of writes on disk
cumulative number of sectors written
cancelled number of written sectors
TGID (group number of related tasks/threads)
obsoleted value ('n')
is_process (y/n)

🫶 PRN

One line per process, net edition 🦋

PID
name (between parenthesis or underscores for spaces)
state
kernel module netatop or netatop-bpf installed ('y' or 'n')
number of TCP-packets transmitted
cumulative size of TCP-packets transmitted
number of TCP-packets received
cumulative size of TCP-packets received
number of UDP-packets transmitted
cumulative size of UDP-packets transmitted
number of UDP-packets received
cumulative size of UDP-packets transmitted
number of raw packets transmitted (obsolete, always 0)
number of raw packets received (obsolete, always 0)
TGID (group number of related tasks/threads) and is_process (y/n)

heads up bestie 🚨 If the kernel module is not active, the network I/O counters per process are not relevant.

🌟 JSON OUTPUT 🌟

With the flag -J followed by a list of one or more labels (comma-separated), JSON output is produced for each sample. And the syntax and name of JSON labels are the same as for the parsable output — so like, if you know the parsable ones you already know these, iykyk 💅

💅 SIGNALS 💅

Send SIGUSR1 to atop and a new sample gets forced, even if the current timer interval has not exceeded yet ⏩ The behavior is similar to pressing the t key in an interactive session.
Send SIGUSR2 to atop and a final sample gets forced, after which atop will terminate 🏁

💖 EXAMPLES 💖

ok so here's where it gets good — these are the actual things you'll be typing, bestie. every single one is copy-pasteable, no cap ✨

Monitor the current system load in text mode with an interval of (default) 10 seconds:

atop

Monitor the current system load as bar graphs with an interval of 5 seconds:

atop -B 5

Monitor the current system load in text mode with an interval of 4 seconds with the possibility to browse back and forth while measuring continues (twin mode):

atop -t 4

Live monitoring of the current system load while writing the measurement to a raw log in parallel (to be viewed later on):

atop -g -w /tmp/sessionx

View the cgroups with the related processes (except kernel processes) with the possibility to review previous samples during the live measurement:

atop -G8 -t

Store information about the system and process activity in binary compressed form to a file with an interval of ten minutes during an hour:

atop -w /tmp/atop.raw 600 6

View the contents of this file interactively:

atop -r /tmp/atop.raw

View the processor and disk utilization of this file in parsable format:

atop -PCPU,DSK -r /tmp/atop.raw

View the contents of today's standard logfile interactively:

atop -r

View the contents of the standard logfile of the day before yesterday interactively:

atop -r yy

View the contents of the standard logfile of 2024, November 5 from 02:00 PM onwards interactively:

atop -r 20241105 -b 1400

Read the contents of today's logfile and show the CPU utilization on system level as parseable output and JSON output:

atop -r -PCPU -JCPU

Concatenate all raw log files of November 2024 and generate parsable output about the CPU utilization:

atopcat /var/log/atop/atop_202403?? | atop -r - -PCPU

Monitor the system load and write it to a file (in plain ASCII) with an interval of one minute during half an hour with active processes sorted on memory consumption:

atop -M 60 30 > /log/atop.mem

🫶 ok that last one is giving "old school and proud" — plain ASCII output redirected straight into a file. lowkey iconic.

🎀 FILES 🎀

these are the paths atop is gonna be poking at, so like… know them, love them 💅

/var/run/pacct_shadow.d/ — Directory containing the process accounting shadow files that are used by atop when the atopacctd daemon is active.
/var/cache/atop.d/atop.acct — File in which the kernel writes the accounting records when atop itself has activated the process accounting mechanism.
/etc/atoprc — Configuration file containing system-wide default values. For further information about the default values, refer to the atoprc man page).
~/.atoprc — Configuration file containing personal default values. For further information about the default values, refer to the atoprc man page).
/etc/default/atop — Configuration file to overrule the settings of atop that runs in the background to create the daily logfile. This file is created when atop is installed. The default settings are:

LOGOPTS=""
LOGINTERVAL=600
LOGGENERATIONS=28

/var/log/atop/atop_YYYYMMDD — Raw file, where YYYYMMDD are digits representing the current date. This name is used by atop running in the background as default name for the output file, and by atop as default name for the input file when using the -r flag. All binary system and process level data in this file has been stored in compressed format.
/var/run/netatop.log — File that contains the netpertask structs containing the network counters of exited processes. These structs are written by the netatopd daemon (which is related to the netatop module) and read by atop after reading the standard process accounting records.

🌸 btw that LOGOPTS="" / LOGINTERVAL=600 / LOGGENERATIONS=28 trio is literally the mood of every background logging setup ever. 600 seconds = 10 min, and it keeps 28 generations. yes bestie, that's the whole vibe.

🌈 SEE ALSO 🌈

your little friend group of related tools and docs, go say hi 👑

atopsar(1), atopconvert(1), atopcat(1), atophide(1), atoprc(5), atopacctd(8), netatop(4), netatopd(8), atopgpud(8), logrotate(8)

https://www.atoptool.nl

👑 AUTHOR 👑

the legends themselves, fr fr 💜

Gerlof Langeveld (gerlof.langeveld@atoptool.nl) JC van Winkel

aaaaaaaaand that's the whole page, bestie!! 🦋 you made it to the very end, so proud of you fr fr. this one comes from the Linux source, version/date stamp side says June 2026, and the page itself is ATOP(1) — go forth and monitor everything, you absolute main character 💅✨

📦 where this page comes from

arch rolling: atop 2.13.0-1 · GPL-2.0-or-later
fedora 44: atop 2.13.0-1.fc44 · GPL-2.0-or-later
nixpkgs unstable: atop 2.13.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-06: a language model's rewrite of the original, under its terms

ATOP(1)

💖 ATOP(1) 💖 — the manual for atop, bestie

✨ NAME ✨

🌸 SYNOPSIS 🌸

🦋 DESCRIPTION 🦋

🧚 TWIN MODE 🧚

🌈 BAR GRAPH MODE 🌈

💻 Processors 💻

🧠 Memory and swap space 🧠

💾 Disks 💾

📡 Interfaces 📡

✨ TEXT MODE IN GENERAL ✨

🧾 PROCESS ACCOUNTING 🧾

🌈 COLORS 🌈

🦋 NETATOP OR NETATOP-BPF MODULE 🦋

🔥 GPU STATISTICS GATHERING 🔥

⭐ INTERACTIVE COMMANDS ⭐

🌈 Miscellaneous interactive commands 🌈

🌈 RAW DATA STORAGE 🌈

💖 OUTPUT DESCRIPTION 💖

🔥 OUTPUT DESCRIPTION - SYSTEM LEVEL 🔥

💅 PRC — Process and thread level totals.

👑 CPU — CPU utilization.

CPL 💻 — CPU load information

GPU 🎮 — GPU utilization (NVIDIA)

MEM 🧠 — memory occupation (two lines)

SWP 🍓 — swap occupation and overcommit info

LLC 🧊 — Last-Level Cache of CPU info

NUM 🧩 — memory utilization per NUMA node (not shown for single NUMA node)

NUC ⚡ — CPU utilization per NUMA node (not shown for single NUMA node)

PAG 🌸 — paging frequency

PSI 🦋 — Pressure Stall Information

🧮 LVM/MDD/DSK — logical volume/multiple device/disk utilization

💖 OUTPUT DESCRIPTION - CGROUPS LEVEL (V2) 💖

🦋 OUTPUT DESCRIPTION - PROCESS LEVEL 🦋

✨ PARSABLE OUTPUT ✨

🦋 IFB

🌸 NUM

⭐ NUC

🎀 CGR

👑 PRG

🔥 PRC

🌈 PRE

🍓 PRM

💀 PRD

🫶 PRN

🌟 JSON OUTPUT 🌟

💅 SIGNALS 💅

💖 EXAMPLES 💖

🎀 FILES 🎀

🌈 SEE ALSO 🌈

👑 AUTHOR 👑

💖 ATOP(1) 💖 — the manual for `atop`, bestie