ATOPSAR(1)

🌈 ATOPSAR(1) 🌈

From the General Commands Manual, bestie: meet atopsar — the Advanced System Activity Report (atop related). It’s giving “system stats but make it organized,” and we’re keeping every flag, fact, and column exactly where it belongs. 💅

💖 NAME 💖

atopsar — Advanced System Activity Report (atop related)

✨ SYNOPSIS ✨

atopsar [-flags...]  [-r file|date|- ] [-R cnt ] [-b [YYYYMMDD]hhmm[ss]
] [-e [YYYYMMDD]hhmm[ss] ]
atopsar [-flags...]  interval [ samples ]

🌸 DESCRIPTION 🌸

The program atopsar can be used to report statistics on system level.

In the first synopsis line — the one with no sampling interval specified — atopsar extracts data from a raw logfile that has been recorded previously by the program atop (option -w of the atop program). You can specify the name of the logfile with the -r option of the atopsar program.

When a daily logfile of atop is used, named /var/log/atop/atop_YYYYMMDD (where YYYYMMDD reflects the date), the required date of the form YYYYMMDD can be specified with the -r option instead of the filename. Or the symbolic name 'y' can be used for yesterday’s daily logfile — and yes, this can be repeated, so 'yyyy' indicates the logfile of four days ago. Or the filename - can be used to read raw data from stdin. If the -r option is not specified at all, today’s daily logfile is used by default. The starting and ending times of the report can be defined using the options -b and -e followed by a time argument of the form [YYYYMMDD]hhmm[ss].

In the second synopsis line, atopsar reads actual activity counters from the kernel with the specified interval (in seconds) and the specified number of samples (optionally). When atopsar is activated in this way it immediately sends the output for every requested report to standard output. If only one type of report is requested, the header is printed once and after every interval seconds the statistical counters are shown for that period. If several reports are requested, a header is printed per sample followed by the statistical counters for that period.

Some generic flags can be specified to influence the behaviour of the atopsar program:

🎛️ Generic flags

• -S — By default the timestamp at the beginning of a line is suppressed if more lines are shown for one interval. With this flag a timestamp is given for every output-line (easier for post-processing).
• -a — By default certain resources as disks and network interfaces are only shown when they were active during the interval. With this flag all resources of a given type are shown, even if they were inactive during the interval.
• -x — By default atopsar only uses colors if output is directed to a terminal (window). These colors might indicate that a critical occupation percentage has been reached (red) or has been almost reached (cyan) for a particular resource. See the man-page of atop for a detailed description of this feature (section COLORS). With the flag -x the use of colors is suppressed unconditionally.
• -C — By default atopsar only uses colors if output is directed to a terminal (window). These colors might indicate that a critical occupation percentage has been reached (red) or has been almost reached (cyan) for a particular resource. See the man-page of atop for a detailed description of this feature (section COLORS). With the flag -C colors will always be used, even if output is not directed to a terminal.
• -M — Use markers at the end of a line to indicate that a critical occupation percentage has been reached ('*') or has been almost reached ('+') for particular resources. The marker '*' is similar to the color red and the marker '+' to the color cyan. See the man-page of atop for a detailed description of these colors (section COLORS).
• -H — Repeat the header line within a report for every N detail lines. The value of N is determined dynamically in case of output to a tty/window (depending on the number of lines); for output to a file or pipe this value is 23.
• -R — Summarize cnt samples into one sample. When the logfile contains e.g. samples of 10 minutes, the use of the flag -R 6 shows a report with one sample for every hour.

Other flags are used to define which reports are required:

📋 Pick your reports

• -A — Show all possible reports.
• -c — Report about CPU utilization (in total and per cpu).
• -g — Report about GPU utilization (per GPU).
• -p — Report about processor-related matters, like load-averages and hardware interrupts.
• -P — Report about processes.
• -m — Current memory- and swap-occupation.
• -s — Report about paging- and swapping-activity, and overcommitment.
• -B — Report about Pressure Stall Information (PSI).
• -l — Report about utilization of logical volumes.
• -f — Report about utilization of multiple devices.
• -d — Report about utilization of disks.
• -n — Report about NFS mounted filesystems on NFS client.
• -j — Report about NFS client activity.
• -J — Report about NFS server activity.
• -i — Report about the network interfaces.
• -I — Report about errors for network-interfaces.
• -w — Report about IP version 4 network traffic.
• -W — Report about errors for IP version 4 traffic.
• -y — General report about ICMP version 4 layer activity.
• -Y — Per-type report about ICMP version 4 layer activity.
• -u — Report about UDP version 4 network traffic.
• -z — Report about IP version 6 network traffic.
• -Z — Report about errors for IP version 6 traffic.
• -k — General report about ICMP version 6 layer activity.
• -K — Per-type report about ICMP version 6 layer activity.
• -U — Report about UDP version 6 network traffic.
• -t — Report about TCP network traffic.
• -T — Report about errors for TCP-traffic.
• -h — Report about Infiniband utilization.
• -O — Report about top-3 processes consuming most processor capacity. This report is only available when using a log file (not when specifying an interval).
• -G — Report about top-3 processes consuming most resident memory. This report is only available when using a log file (not when specifying an interval).
• -D — Report about top-3 processes issuing most disk transfers. This report is only available when using a log file (not when specifying an interval).
• -N — Report about top-3 processes issuing most IPv4/IPv6 socket transfers. This report is only available when using a log file (not when specifying an interval).

📊 OUTPUT DESCRIPTION 📊

Depending on the requested report, a number of columns with output values are produced. The values are mostly presented as a number of events per second.

🖥️ Output for -c

The output for the flag -c contains the following columns per cpu:

• usr% — Percentage of cpu-time consumed in user mode (program text) for all active processes running with a nice value of zero (default) or a negative nice value (which means a higher priority than usual). The cpu consumption in user mode of processes with a nice value larger than zero (lower priority) is indicated in the nice%-column.
• nice% — Percentage of cpu time consumed in user mode (i.e. program text) for all processes running with a nice value larger than zero (which means with a lower priority than average).
• sys% — Percentage of cpu time consumed in system mode (kernel text) for all active processes. A high percentage usually indicates a lot of system calls being issued.
• irq% — Percentage of cpu time consumed for handling of device interrupts.
• softirq% — Percentage of cpu time consumed for soft interrupt handling.
• steal% — Percentage of cpu time stolen by other virtual machines running on the same hardware.
• guest% — Percentage of cpu time used by other virtual machines running on the same hardware (overlaps with usr%/nice%).
• wait% — Percentage of unused cpu time while at least one of the processes in wait-state awaits completion of disk I/O.
• idle% — Percentage of unused cpu time because all processes are in a wait-state but not waiting for disk-I/O.

🎮 Output for -g

The output for the flag -g contains the following columns per GPU:

• busaddr — GPU number and bus-ID (separated by '/').
• gpubusy — GPU busy percentage during interval.
• membusy — GPU memory busy percentage during interval, i.e. time to issue read and write accesses on memory.
• memocc — Percentage of memory occupation at this moment.
• memtot — Total memory available.
• memuse — Used GPU memory at this moment.
• gputype — Type of GPU.

🧠 Output for -p

The output for the flag -p contains the following values:

• pswch/s — Number of process switches (also called context switches) per second on this cpu. A process switch occurs at the moment that an active thread (i.e. the thread using a cpu) enters a wait state or has used its time slice completely; another thread will then be chosen to use the cpu.
• devintr/s — Number of hardware interrupts handled per second on this cpu.
• clones/s — The number of new threads started per second.
• loadavg1 — Load average reflecting the average number of threads in the runqueue or in non-interruptible wait state (usually waiting for disk or tape I/O) during the last minute.
• loadavg5 — Load average reflecting the average number of threads in the runqueue or in non-interruptible wait state (usually waiting for disk or tape I/O) during the last 5 minutes.
• loadavg15 — Load average reflecting the average number of threads in the runqueue or in non-interruptible wait state (usually waiting for disk or tape I/O) during the last 15 minutes.

🧵 Output for -P

The output for the flag -P contains information about the processes and threads:

• clones/s — The number of new threads started per second.
• pexit/s — The original page just drops the name here and gives no extra description, so that’s all we’ve got, bestie. 🙈
• curproc — Total number of processes present in the system.
• curzomb — Number of zombie processes present in the system.
• trun — Total number of threads present in the system in state 'running'.
• tslpi — Total number of threads present in the system in state 'interruptible sleeping'.
• tslpu — Total number of threads present in the system in state 'uninterruptible sleeping'.
• tidle — Total number of threads present in the system in state 'idle' (uninterruptible sleeping but not counted in the load average).

💾 Output for -m

The output for the flag -m contains information about the memory- and swap-utilization:

• memtotal — Total usable main memory size.
• memfree — Available main memory size at this moment (snapshot).
• buffers — Main memory used at this moment to cache metadata-blocks (snapshot).
• cached — main memory being used right now to cache data-blocks (snapshot). lowkey the page cache doing its thing 💅
• dirty — how much memory in the page cache still has to be flushed to disk at this very moment (snapshot). she's got unfinished business 😭
• slabmem — main memory used at this moment for dynamically allocated memory by the kernel (snapshot). kernel's own little stash ✨
• swptotal — total swap space size at this moment (snapshot).
• swpfree — available swap space at this moment (snapshot).

---

So when you hit it with -s, the output is all about how much swapping is going on. Obsessed with how unhinged these numbers can get 🌀

• pagescan/s — number of scanned pages per second, and the reason is literally that free memory dropped below a particular threshold. the system is scavenging fr
• swapin/s — number of memory-pages the system read from the swap-device per second.
• swapout/s — number of memory-pages the system wrote to the swap-device per second.
• oomkill — number of processes killed during the last interval due to lack of memory/swap. the value -1 means this counter is not supported by the current kernel version. rest in pieces bestie 💀
• commitspc — the committed virtual memory space, i.e. the reserved virtual space for all allocations of private memory space for processes.
• commitlim — the maximum limit for the committed space, which is by default swap size plus 50% of memory size. the kernel only checks whether the committed space exceeds the limit if strict overcommit handling is configured (vm.overcommit_memory is 2). no cap, only checked under that config 🫶

---

The -B output is all Pressure Stall Information (PSI), and it's giving stress-monitor energy 🌸

• cpusome — average pressure percentage during the interval for the category 'CPU some'.
• memsome — average pressure percentage during the interval for the category 'memory some'.
• memfull — average pressure percentage during the interval for the category 'memory full'.
• iosome — average pressure percentage during the interval for the category 'I/O some'.
• iofull — average pressure percentage during the interval for the category 'I/O full'.

---

Now for -l (LVM), -f (MD), and -d (hard disk): these give you the following columns per active unit 💖

• disk — name.
• busy — busy-percentage of the unit (i.e. the portion of time that the device was busy handling requests).
• read/s — number of read-requests issued per second on this unit.
• KB/read — average number of Kbytes transferred per read-request for this unit.
• writ/s — number of write-requests (including discard requests) issued per second on this unit. yes discard counts, periodt.
• KB/writ — average number of Kbytes transferred per write-request for this unit.
• avque — average number of requests outstanding in the queue during the time that the unit is busy.
• avserv — average number of milliseconds needed by a request on this unit (seek, latency and data-transfer).

---

The flag -n? that's everything going on with NFS mounted filesystems, client side 🦋

• mounted_device — mounted device containing server name and server directory being mounted.
• physread/s — kilobytes data physically read from the NFS server by processes running on the NFS client.
• KBwrite/s — kilobytes data physically written to the NFS server by processes running on the NFS client. when the NFS filesystem was mounted during the interval, the state 'M' is shown.

---

Flag -j is NFS client activity, and it's giving busy little bee 🐝

• rpc/s — number of RPC calls per second issued to NFS server(s).
• rpcread/s — number of read RPC calls per second issued to NFS server(s).
• rpcwrite/s — number of write RPC calls per second issued to NFS server(s).
• retrans/s — number of retransmitted RPC calls per second.
• autrefresh/s — number of authorization refreshes per second.

---

Flag -J flips it to NFS server activity, main character energy on the other side of the wire 👑

• rpc/s — number of RPC calls per second received from NFS client(s).
• rpcread/s — number of read RPC calls per second received from NFS client(s).
• rpcwrite/s — number of write RPC calls per second received from NFS client(s).
• MBcr/s — number of Megabytes per second returned to read requests by clients.
• MBcw/s — number of Megabytes per second passed in write requests by clients.
• nettcp/s — number of requests per second handled via TCP.
• netudp/s — number of requests per second handled via UDP.

---

Flag -i is all about how hard your network interfaces are working 💅

• interf — name of interface.
• busy — busy percentage for this interface. if the linespeed of this interface could not be determined (for virtual interfaces or in case that atop or atopsar had no root-privileges), a question mark is shown. she's mysterious like that 🙈
• ipack/s — number of packets received from this interface per second.
• opack/s — number of packets transmitted to this interface per second.
• iKbyte/s — number of Kbytes received from this interface per second.
• oKbyte/s — number of Kbytes transmitted via this interface per second.
• imbps/s — effective number of megabits received per second.
• ombps/s — effective number of megabits transmitted per second.
• maxmbps/s — linespeed as number of megabits per second. if the linespeed could not be determined (for virtual interfaces or in case that atop or atopsar had no root-privileges), value 0 is shown. the linespeed is followed by the indication 'f' (full duplex) or 'h' (half duplex). iconic little suffix ngl 🌈

---

Flag -I? that's the failures report for network interfaces, aka the drama report 😭

• interf — name of interface.
• ierr/s — number of bad packets received from this interface per second.
• oerr/s — number of times that packet transmission to this interface failed per second.
• coll/s — number of collisions encountered per second while transmitting packets.
• idrop/s — number of received packets dropped per second due to lack of buffer-space in the local system.
• odrop/s — number of transmitted packets dropped per second due to lack of buffer-space in the local system.
• iframe/s — number of frame alignment-errors encountered per second on received packets.
• ocarrier/s — number of carrier-errors encountered per second on transmitted packets.

---

Flag -w shows utilization of the IPv4-layer, and the formal SNMP-names are between brackets if you wanna cross-reference 🧚

• inrecv/s — number of IP datagrams received from interfaces per second, including those received in error (ipInReceives).
• outreq/s — number of IP datagrams that local higher-layer protocols supplied to IP in requests for transmission per second (ipOutRequests).
• indeliver/s — number of received IP datagrams that have been successfully delivered to higher protocol-layers per second (ipInDelivers).
• forward/s — number of received IP datagrams per second for which this entity was not their final IP destination, as a result of which an attempt was made to forward (ipForwDatagrams).
• reasmok/s — number of IP datagrams successfully reassembled per second (ipReasmOKs).
• fragcreat/s — number of IP datagram fragments generated per second at this entity (ipFragCreates).

---

Flag -W is the IPv4-layer failure report (formal SNMP-names between brackets again, iykyk) 🔥

• in: dsc/s — number of input IP datagrams per second for which no problems were encountered to prevent their continued processing but that were discarded, e.g. for lack of buffer space (ipInDiscards).
• in: hder/s — number of input IP datagrams per second discarded due to errors in the IP header (ipInHdrErrors).
• in: ader/s — number of input IP datagrams per second discarded because the IP address in the destination field was not valid to be received by this entity (ipInAddrErrors).
• in: unkp/s — number of inbound packets per second that were discarded because of an unknown or unsupported protocol (ipInUnknownProtos).
• in: ratim/s — number of timeout-situations per second while other fragments were expected for successful reassembly (ipReasmTimeout).
• in: rfail/s — number of failures detected per second by the IP reassembly algorithm (ipReasmFails).
• out: dsc/s — number of output IP datagrams per second for which no problems were encountered to prevent their continued processing but that were discarded, e.g. for lack of buffer space (ipOutDiscards).
• out: nrt/s — number of IP datagrams per second discarded because no route could be found (ipOutNoRoutes). lost in the void fr 💀

---

Flag -y gives you the general utilization of the ICMPv4-layer plus some info per type of ICMP-message (formal SNMP-names between brackets) 🎀

• intot/s — number of ICMP messages (any type) received per second at this entity (icmpInMsgs).
• outtot/s — number of ICMP messages (any type) transmitted per second from this entity (icmpOutMsgs).
• inecho/s — number of ICMP Echo (request) messages received per second (icmpInEchos).
• inerep/s — number of ICMP Echo-Reply messages received per second (icmpInEchoReps).
• otecho/s — number of ICMP Echo (request) messages transmitted per second (icmpOutEchos).
• oterep/s — number of ICMP Echo-Reply messages transmitted per second (icmpOutEchoReps).

---

And flag -Y is for the other types of ICMPv4-messages (formal SNMP-names between brackets, as always bestie) 🦋

• ierr/s — number of ICMP messages received per second but determined to have ICMP-specific errors (icmpInErrors).
• isq/s — number of ICMP Source Quench messages received per second (icmpInSrcQuenchs).
• ird/s — number of ICMP Redirect messages received per second (icmpInRedirects).
• idu/s — number of ICMP Destination Unreachable messages received per second (icmpInDestUnreachs).
• ite/s — number of ICMP Time Exceeded messages received per second (icmpOutTimeExcds).
• oerr/s — how many ICMP messages per second got sent out but were flagged as having ICMP-specific errors (icmpOutErrors). messy but iconic 💅
• osq/s — ICMP Source Quench messages flying out per second (icmpOutSrcQuenchs).
• ord/s — ICMP Redirect messages out per second (icmpOutRedirects).
• odu/s — ICMP Destination Unreachable messages out per second (icmpOutDestUnreachs).
• ote/s — ICMP Time Exceeded messages out per second (icmpOutTimeExcds).

---

Okay so the flag -u is gonna spill the tea on how the UDPv4-layer is doing — formal SNMP-names live in the brackets, bestie:

• indgram/s — UDP datagrams per second that actually got delivered to UDP users (udpInDatagrams). slay, they made it 💖
• outdgram/s — UDP datagrams per second heading out from this entity (udpOutDatagrams).
• inerr/s — received UDP datagrams per second that could NOT be delivered for reasons other than there just being no app sitting at the destination port (udpInErrors).
• noport/s — received UDP datagrams per second where there was literally no application at the destination port (udpNoPorts). ghosted 🫥

---

The flag -z gives you the IPv6-layer utilization (formal SNMP-names in brackets again, iykyk):

• inrecv/s — input IPv6-datagrams per second received from interfaces, counting the ones received in error too (ipv6IfStatsInReceives).
• outreq/s — IPv6-datagrams per second that local higher-layer protocols handed to IP in requests for transmission (ipv6IfStatsOutRequests). note bestie: this counter does not include any forwarded datagrams.
• inmc/s — multicast packets per second received by the interface (ipv6IfStatsInMcastPkts).
• outmc/s — multicast packets per second transmitted to the interface (ipv6IfStatsOutMcastPkts).
• indeliv/s — IP datagrams per second successfully delivered to IPv6 user-protocols, ICMP included (ipv6IfStatsInDelivers).
• reasmok/s — IPv6 datagrams per second successfully reassembled (ipv6IfStatsReasmOKs). the glow-up after being in pieces ✨
• fragcre/s — IPv6 datagram fragments per second generated at this entity (ipv6IfStatsOutFragCreates).

---

Now the flag -Z is the failure report for the IPv6-layer (formal SNMP-names in brackets):

• in: dsc/s — input IPv6 datagrams per second with no problems blocking their continued processing, but that got discarded anyway — e.g. for lack of buffer space (ipv6IfStatsInDiscards).
• in: hder/s — input datagrams per second discarded due to errors in the IPv6 header (ipv6IfStatsInHdrErrors).
• in: ader/s — input datagrams per second discarded because the IPv6 address in the destination field wasn't valid to be received by this entity (ipv6IfStatsInAddrErrors).
• in: unkp/s — locally-addressed datagrams per second discarded because of an unknown or unsupported protocol (ipv6IfStatsInUnknownProtos).
• in: ratim/s — timeout-situations per second while other IPv6 fragments were still expected for successful reassembly (ipv6ReasmTimeout). we were all rooting for that reassembly 😭
• in: rfail/s — failures per second detected by the IPv6 reassembly-algorithm (ipv6IfStatsReasmFails).
• out: dsc/s — output IPv6 datagrams per second that hit no problems preventing continued processing but got discarded anyway — e.g. for lack of buffer space (ipv6IfStatsOutDiscards).
• out: nrt/s — IPv6 datagrams per second discarded because no route could be found (ipv6IfStatsInNoRoutes). literally lost, no map, no vibe check 🌸

---

Flag -k? general utilization of the ICMPv6-layer plus some per-type ICMP-message tea (formal SNMP-names in brackets):

• intot/s — ICMPv6 messages (any type) received per second at the interface (ipv6IfIcmpInMsgs).
• outtot/s — ICMPv6 messages (any type) transmitted per second from this entity (ipv6IfIcmpOutMsgs).
• inerr/s — ICMPv6 messages received per second that had ICMP-specific errors — bad ICMP checksums, bad length, etc. (ipv6IfIcmpInErrors).
• innsol/s — ICMP Neighbor Solicit messages received per second (ipv6IfIcmpInNeighborSolicits).
• innadv/s — ICMP Neighbor Advertisement messages received per second (ipv6IfIcmpInNeighborAdvertisements).
• otnsol/s — ICMP Neighbor Solicit messages transmitted per second (ipv6IfIcmpOutNeighborSolicits).
• otnadv/s — ICMP Neighbor Advertisement messages transmitted per second (ipv6IfIcmpOutNeighborAdvertisements).

---

Flag -K covers the other ICMPv6-message types (formal SNMP-names in brackets, always):

• iecho/s — ICMP Echo (request) messages received per second (ipv6IfIcmpInEchos).
• ierep/s — ICMP Echo-Reply messages received per second (ipv6IfIcmpInEchoReplies).
• oerep/s — ICMP Echo-Reply messages transmitted per second (ipv6IfIcmpOutEchoReplies).
• idu/s — ICMP Destination Unreachable messages received per second (ipv6IfIcmpInDestUnreachs).
• odu/s — ICMP Destination Unreachable messages transmitted per second (ipv6IfIcmpOutDestUnreachs).
• ird/s — ICMP Redirect messages received per second (ipv6IfIcmpInRedirects).
• ord/s — ICMP Redirect messages transmitted per second (ipv6IfIcmpOutRedirect).
• ite/s — ICMP Time Exceeded messages received per second (ipv6IfIcmpInTimeExcds).
• ote/s — ICMP Time Exceeded messages transmitted per second (ipv6IfIcmpOutTimeExcds).

---

Flag -U = the UDPv6-layer utilization check-in (formal SNMP-names in brackets):

• indgram/s — UDPv6 datagrams per second delivered to UDP users (udpInDatagrams),
• outdgram/s — UDPv6 datagrams per second transmitted from this entity (udpOutDatagrams),
• inerr/s — received UDPv6 datagrams per second that couldn't be delivered for reasons other than the lack of an application at the destination port (udpInErrors).
• noport/s — received UDPv6 datagrams per second for which there was no application at the destination port (udpNoPorts).

---

Flag -t → TCP-layer utilization era (formal SNMP-names in brackets):

• insegs/s — received segments per second, including those received in error (tcpInSegs).
• outsegs/s — transmitted segments per second, not counting the ones containing only retransmitted octets (tcpOutSegs).
• actopen/s — active opens per second this entity has supported (tcpActiveOpens).
• pasopen/s — passive opens per second this entity has supported (tcpPassiveOpens).
• nowopen — number of connections currently open (a snapshot, bestie), where the state is either ESTABLISHED or CLOSE-WAIT (tcpCurrEstab).

---

Flag -T = the TCP-layer failures report (formal SNMP-names in brackets):

• inerr/s — received segments per second that came in with errors (tcpInErrs).
• retrans/s — retransmitted segments per second (tcpRetransSegs).
• attfail/s — failed connection attempts per second that happened at this entity (tcpAttemptFails).
• estabreset/s — resets per second that occurred at this entity (tcpEstabResets).
• outreset/s — transmitted segments per second carrying the RST flag (tcpOutRsts).

---

Flag -h is all about Infiniband port utilization 👑

• controller — name of controller.
• port — controller port.
• busy — busy percentage for this port.
• ipack/s — packets received from this port per second.
• opack/s — packets transmitted to this port per second.
• igbps/s — effective number of gigabits received per second.
• ogbps/s — effective number of gigabits transmitted per second.
• maxgbps/s — maximum rate as number of gigabits per second.
• lanes — number of lanes.

---

Flag -O spills the top-3 of processes with the highest processor consumption:

• pid — process-id (if it's zero, the process has exited while the pid couldn't be determined 👻).
• command — the name of the process.
• cpu% — the percentage of cpu-capacity being consumed. heads up: this value can exceed 100% for a multithreaded process running on a multiprocessor machine 🔥

---

Flag -G → the top-3 of processes with the highest memory consumption:

• pid — process-id (zero again means the process exited and the pid couldn't be determined).
• command — the name of the process.
• mem% — the percentage of resident memory-utilization by this process.

---

Flag -D → top-3 of processes issuing the most read and write accesses to disk:

• pid — process-id (if zero, the process has exited while the pid could not be determined).
• command — the name of the process.
• dsk% — the percentage of read and write accesses relative to the total number of read and write accesses issued on disk by all processes — so ngl, a high percentage does not imply a high disk load on system level. read it again, bestie 🫶

---

Flag -N → top-3 of processes issuing the most socket transfers for IPv4/IPv6:

• pid — process-id (if zero, the process has exited while the pid could not be determined).
• command — the name of the process.

One last output stat before we bounce, and it's lowkey important:

• net% — the percentage of socket transfers compared to the total number of transfers issued by all processes, so a high percentage does not imply a high network load at system level. Do not let this one number gaslight you into thinking the whole box is drowning in network traffic. 💅

---

✨ EXAMPLES ✨

Okay bestie, here's where it gets fun. These are literally copy-paste ready:

See today's cpu-activity so far — assuming atop is logging in the background:

atopsar

See the memory occupation for June 5, 2018 between 10:00 and 12:30 — assuming atop has been logging daily in the background:

atopsar -m -r /var/log/atop_20180605 -b 10:00 -e 12:30

or:

atopsar -m -r 20180605 -b 10:00 -e 12:30

or — suppose it is June 8, 2018 at this moment:

atopsar -m -r yyy -b 10:00 -e 12:30

Write a logfile with atop to record the system behaviour for 30 minutes (30 samples of one minute) and produce all available reports afterwards:

atop -w /tmp/atoplog 60 30

atopsar -A -r /tmp/atoplog

Watch TCP activity evolve for ten minutes (10 samples with sixty seconds interval):

atopsar -t 60 10

Watch the header-lines ('_' as last character) of all reports with only the detail-lines showing critical resource consumption (marker '*' or '+' as last character):

atopsar -AM | grep '[_*+]$'

---

🎀 FILES 🎀

• /etc/atoprc — configuration file containing system-wide default values (mainly flags). See related man-page.
• ~/.atoprc — configuration file containing personal default values (mainly flags). See related man-page.
• /var/log/atop/atop_YYYYMMDD — daily data file, where YYYYMMDD are digits representing the date.

---

🦋 SEE ALSO 🦋

Go read these too, iykyk: atop(1), atoprc(5), atopcat(1), atophide(1), atopconvert(1), atopacctd(8), netatop(4), netatopd(8), and the tool's home page at https://www.atoptool.nl.

---

👑 AUTHOR 👑

Gerlof Langeveld (gerlof.langeveld@atoptool.nl) — periodt. 💖

---

That's the whole page, bestie. The source/version + date footer energy is Linux, January 2024, ATOPSAR(1). Go check your stats and slay. 🎀✨