Use the atop tool to monitor Linux metrics - Elastic Compute Service

Use atop to monitor system and process activity in real time or replay binary log snapshots for historical diagnosis.

Install atop

Log on to a Linux instance using Workbench.

Install atop:

Alibaba Cloud Linux 4/3/2, CentOS 7/8, or Fedora

# Update packages.
sudo yum update -y

# Install atop.
sudo yum install atop -y

Ubuntu or Debian

# Update packages.
sudo apt update -y

# Install atop.
sudo apt install atop -y

CentOS Stream 9 or Rocky Linux 9

# Update packages.
sudo dnf update -y

# Install the EPEL repository.
sudo dnf install epel-release -y

# Install atop.
sudo dnf install atop -y

openSUSE

# Update packages.
sudo zypper update -y

# Install atop.
sudo zypper install atop atop-daemon -y

Start the atop service:
```
sudo systemctl start atop
```
Verify that the atop service started.
Run sudo systemctl status atop. The active (running) status indicates success.

View real-time metrics

Run atop [sampling_interval_in_seconds] [number_of_samples] to enter interactive mode. The output has two sections: system resource overview and process details.

# View with default settings (refreshes every 10 seconds).
atop

# View system metrics every 5 seconds.
atop 5

# Collect system metrics 30 times at 10-second intervals.
atop 10 30

# Collect metrics 10 times at 30-second intervals and write the results to a file.
atop 30 10 > /tmp/atop.mem

System resource overview: Summarizes CPU, memory, swap, disk I/O, and network usage.

ATOP -                            2025/09/17  15:04:49                            ----------------                      10s elapsed
PRC | sys    0.07s | user  0.07s |              | #proc    102 | #trun        1 | #tslpi    202 |              | #tslpu     40 | #zombie    0 | clones      4 |              | #exit      0
CPU | sys       1% | user     1% |              | irq       1% |              | idle     198% | wait      0% | steal      0% |              | guest      0% |              | curf 2.50GHz
cpu | sys       0% | user     0% |              | irq       0% |              | idle      99% | cpu000 w  0% | steal      0% |              | guest      0% |              | curf 2.50GHz
cpu | sys       0% | user     1% |              | irq       0% |              | idle      99% | cpu001 w  0% | steal      0% |              | guest      0% |              | curf 2.50GHz
CPL | avg1    0.01 |              | avg5    0.03 | avg15   0.04 |              |              | csw    43494 |              | intr   22870 |              |              | numcpu      2 |
MEM | tot    1.9G | free  240.7M |              | cache   1.1G | dirty   0.3M | buff   51.8M | slab  104.4M | slrec  69.4M | shmem   2.0M | shrss   0.0M | shswp   0.0M |              | numnode     1
                                                                                                                                           | vmcom 728.4M |              | vmlim 952.1M |
SWP | tot    0.0M |              | free    0.0M | swcac   0.0M |              |              |              |              |              |              |              |              |
DSK |         vda | busy      0% |              | read       0 | write       4 |              | discrd     0 | KiB/r        | KiB/w     19 | KiB/d      0 | MBr/s      0 | MBw/s        |              | avq  0.50 avio 0.50 ms
NET | transport   | tcpi      89 | tcpo     131 | udpi      13 |              | udpo      13 | tcpao      9 | tcppo      0 | tcprs      0 | tcpie      0 | tcpor      0 |              | udpnp      0 | udpie        0
NET | network     | ipi     102  |              | ipo     108  | ipfrw      0 |              | deliv    102 |              | coll       0 | mlti       0 | erri       0 |              | icmpi      0 | icmpo        0
NET | eth0   ---- | pcki    108  | pcko    110  |              | sp    0 Mbps | si    17 Kbps | so    66 Kbps |              |              |              | erri       0 | erro       0 | drpi       0 | drpo         0

Process-level details: Shows resource consumption per process.

PID        TID      TCPRCV    TCPRASZ    TCPSND    TCPSASZ    UDPRCV    UDPRASZ    UDPSND    UDPSASZ    BANDWI         BANDWO         NET    CMD    1/
6605        -        38        193        33        1569        4        205        4        126        6 Kbps        41 Kbps        57%
6660        -        25        183        33        676        5        204        5        106        4 Kbps        18 Kbps        27%
7429        -        12        507        17        125        4        142        4        101        5 Kbps        2 Kbps        9%
1588        -        10        70        10        396        0        0        0        0        0 Kbps        3 Kbps        4%
1179        -        4        58        2        1792        0        0        0        0        0 Kbps        2 Kbps        4%
1201        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
7486        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
17891        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
7539        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
2116        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
641        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
7157        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
1108        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
979        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
652        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
11        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
12        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
29        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
31        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
90        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
129        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
130        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
157        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
352        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
7107        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
7186        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
7631        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%
17612        -        0        0        0        0        0        0        0        0        0 Kbps        0 Kbps        0%

Use single-letter keys to switch views or sort processes in interactive mode.

Key	Function	Purpose
c	Display the full command line	View the startup parameters of a process.
g	Generic view (default)	Summary of CPU, memory growth, and disk I/O.
m/M	Memory view/Sort by memory	Analyze memory usage, page faults, and memory leaks.
d/D	Disk view/Sort by disk	Identify processes with high disk read/write activity.
n/N	Network view/Sort by network (requires you to install and load the netatop kernel module)	Identify processes with high network traffic.
a	Aggregation view	Aggregate resource consumption of all threads or processes per program.
C	Sort by CPU	Identify the most CPU-intensive processes.
h	Show help	List all keyboard shortcuts.
q	Quit	Exit interactive mode.

View historical metrics

The atop service periodically writes binary log files to the /var/log/atop/ directory, named in atop_YYYYMMDD format.

atop logs are binary files. Opening them with a text editor like cat, less, or vim displays unreadable characters.

Read historical logs

Read a historical log file:

Run atop -r <log_file> to load a log file.

# View today's log. atop automatically finds the log file for the current day.
atop -r

# View the log for a specific date.
atop -r /var/log/atop/atop_YYYYMMDD

Navigate to a specific time in the log:
When you load a log file, the first snapshot is displayed.
1. Press t to jump to the next snapshot.
2. Press T (uppercase) to jump to the previous snapshot.
3. Press b and enter a time in HH:MM format to jump to that time.
Filter a time range directly from the command line:
To view resource usage for a specific time range without manually navigating through snapshots, use the -b (begin) and -e (end) options with atop -r:
```
atop -r /var/log/atop/atop_YYYYMMDD -b HH:MM -e HH:MM
```
- -b HH:MM: Start time. atop displays snapshots from this time onward.
- -e HH:MM: End time. atop stops replaying at this time.
Example: To review process resource usage between 02:00 and 03:00 on August 15, 2025 (for example, to investigate an anomaly at a known time):
```
atop -r /var/log/atop/atop_20250815 -b 02:00 -e 03:00
```

Configure logging behavior

Adjust the logging frequency, retention period, and storage path by modifying the atop configuration file.

Open the configuration file with vim or another editor:
- For RHEL and its derivatives (Alibaba Cloud Linux, CentOS, Fedora, and Rocky Linux):
```
sudo vim /etc/sysconfig/atop
```
- For Debian and its derivatives (Ubuntu and Debian) and openSUSE:
```
sudo vim /etc/default/atop
```
The default configuration contains the following parameters:
```
LOGOPTS=""
LOGINTERVAL=600
LOGGENERATIONS=28
LOGPATH=/var/log/atop
```
- LOGOPTS: Additional logging options. Setting -L creates a symbolic link at /var/log/atop/atop_current pointing to the latest log file for quick access during log rotation.
- LOGINTERVAL: Sampling interval in seconds. Default: 600 (10 minutes), meaning atop records a snapshot every 10 minutes.
- LOGGENERATIONS: Log retention in days. Default: 28. atop deletes older logs automatically.
- LOGPATH: Log storage path. Default: /var/log/atop.
  Ensure the new directory exists and atop has write permissions.
Restart the atop service to apply changes:
```
sudo systemctl restart atop
```

Generate metric reports

atopsar extracts data from atop binary log files to generate system performance reports.

Examples

Generate a CPU utilization report over a 1-minute period (12 samples at 5-second intervals):
```
atopsar -c 5 12
```

Generate a memory report for a specific time range today:

# View the memory metric report for today from 18:00 to 18:01.
atopsar -m -b 18:00 -e 18:01

Generate a memory report for a specific time range on a specific date:

# View the memory metric report for August 15, 2025, from 18:00 to 18:01.
atopsar -m -r /var/log/atop/atop_20250815 -b 18:00 -e 18:01

atopsar command syntax

atopsar [options] [interval] [count]

[options]: Report type flags, such as -c (CPU), -m (memory), and -d (disk).
[interval]: Report output interval in seconds.
[count]: Number of report iterations.

Metric reference

System resource overview

Metric Category	Metric	Description	Unit
ATOP	Hostname, Date	Hostname, sampling date, and time.	-
ATOP	Sampling interval	Time interval between two samples.	Seconds
PRC (Process totals)	`sys`	Total CPU time consumed by all processes in kernel mode.	Seconds
	`user`	Total CPU time consumed by all processes in user mode.	Seconds
	`#proc`	Total number of processes.	Unit
	`#trun`	Average number of running threads.	Unit
	`#tslpi`	Number of threads in interruptible sleep.	Item
	`#tslpu`	Number of threads in uninterruptible sleep.	Unit
	`#zombie`	Number of zombie processes.	Unit
	`clones`	New processes or threads created via clone during the interval.	Count/second
	`#exit`	Processes that exited during the interval.	Count/second
CPU/cpu (Total/Per core)	`%sys`	CPU time spent in kernel mode.	%
	`%user`	CPU time spent in user mode.	%
	`%irq`	CPU time spent handling hardware interrupts (irq) and software interrupts (softirq).	%
	`%idle`	CPU completely idle.	%
	`%wait`	CPU idle while waiting for disk I/O.	%
	`%steal`	Time a virtual CPU waited for a physical CPU (stolen by the host or other VMs).	%
	`%guest`	CPU time spent running a virtual machine.	%
	`%freq`	Average CPU frequency as a percentage of maximum.	%
CPL (CPU load)	`avg1`/`avg5`/`avg15`	System load average over the last 1, 5, and 15 minutes.	-
	`csw`	Context switches during the interval.	Count/second
	`intr`	Total interrupts during the interval.	Count/second
MEM (Physical memory)	`tot`	Total physical memory.	GiB/MiB
	`free`	Unused free memory.	GiB/MiB
	`cache`	Memory used as page cache for file data.	GiB/MiB
	`dirty`	Dirty pages modified but not yet written to disk.	MiB
	`buff`	Memory used as buffer cache for block device metadata.	MiB
	`slab`	Memory used by the kernel slab allocator.	MiB
	`shmem`	Shared memory size, including tmpfs.	MiB
	`vmbal`	(32-bit systems only) Balanced memory for virtual memory areas.	MiB
SWP (Swap partition)	`tot`	Total swap space.	GiB/MiB
	`free`	Free swap space.	GiB/MiB
	`swcac`	Memory swapped out but still cached.	MiB
	`vmcom`	Total virtual memory committed by applications.	GiB/MiB
	`vmlim`	Maximum virtual memory that can be committed.	GiB/MiB
PAG (Paging activity)	`scan`	Pages scanned by the kernel to reclaim memory.	Pages/second
	`steal`	Pages successfully reclaimed after scanning.	Pages/second
	`stall`	Stalls caused by insufficient memory during page reclamation.	Count/second
	`swin`	Pages swapped in from swap to physical memory.	Pages/second
	`swout`	Pages swapped out from physical memory to swap.	Pages/second
DSK (Disk) LVM (Logical Volume)	`busy`	Disk busy percentage. 100% indicates saturation.	%
	`read`/`write`	Read/write requests completed during the interval.	Count/second
	`KiB/r`/`KiB/w`	Average data size per read/write request.	KB
	`Msec/r`/`Msec/w`	Average time per read/write request, including queuing and service time.	Milliseconds
	`avio`	Average I/O service time, excluding queuing.	Milliseconds
NET (Network)	`transport`	TCP and UDP layer packet statistics.	Packets/second
	`network`	IP layer packet statistics: received, sent, and forwarded.	Packets/second
	`if`	Activity for each network interface.	-
	`pcki`/`pcko`	Packets received/sent by the interface.	Packets/second
	`spdi`/`spdo`	Receive/send data speed.	Mbps
	`erri`/`erro`	Receive/send errors on the interface.	Count/second
	`drpi`/`drpo`	Packets dropped during receive/send on the interface.	Count/second

Process-level details

View	Metric	Description	Unit
Generic view (default)	`PID`	Unique process identifier.	-
	`S`	R-running, S-interruptible sleep, D-uninterruptible sleep, Z-zombie, E-exited.	-
	`CPU%`	CPU utilization percentage.	%
	`MEM%`	Memory usage percentage.	%
	`THR`	Number of threads.	Unit
	`PAG`	Major page faults — reads from disk into memory. Indicates disk I/O pressure.	Count/second
	`CMD`	Executable name. Press c to show the full command line.	-
Memory view	`VSIZE`	Total virtual address space requested by the process.	KiB/MiB/GiB
	`RSIZE`	Physical memory currently occupied by the process.	KiB/MiB/GiB
	`SHR`	Shared memory size.	KiB/MiB/GiB
	`RGROW`	Resident memory growth. Positive = increasing, negative = decreasing.	KiB
	`VGROW`	Virtual memory growth.	KiB
Disk view	`DSK%`	Percentage of total disk busy time caused by this process.	%
	`RDDSK`/`WRDSK`	Disk data read/written.	KiB/MB
	`WCANCL`	Data written to page cache but deleted before being synced to disk.	KiB/MB
Network view	`NET%`	Percentage of total network traffic generated by this process.	%
	`TCPSND`/`TCPRCV`	TCP data sent/received.	KiB/MB
	`UDPSND`/`UDPRCV`	UDP data sent/received.	KiB/MB

Apply in production

Disk space planning: atop log size depends on collection frequency, process count, and retention period. Check a single log file size with ls -lh /var/log/atop/ and multiply by LOGGENERATIONS to estimate total usage.
Monitoring interval: For granular analysis, set LOGINTERVAL to 30 seconds. Shorter intervals increase disk I/O and CPU overhead of atop. Adjust based on your workload.

FAQ

Why do I get the error stat raw file: No such file or directory when running atop -r?
This error means atop cannot find the log file for the specified date. Possible reasons:
1. The atop service was not running on that date.
2. The log was deleted by log rotation (LOGGENERATIONS exceeded).
3. The queried date is in the future.
  Check /var/log/atop for available log files.
How can I reduce atop's disk space usage?
Modify the configuration file and restart the atop service:
1. Reduce the log retention period: Lower the value of LOGGENERATIONS in the configuration file, for example, from 28 to 14.
2. Decrease the collection frequency: Increase the value of LOGINTERVAL in the configuration file, for example, from 600 to 1200.

Why can't I see per-process network traffic when I press the `n` key in atop's interactive mode?

atop does not track per-process network traffic by default. Install and load the netatop kernel module to enable this.

Install the kernel development package and compilation tools:
```
sudo yum install -y kernel-devel dkms elfutils-libelf-devel
```

Download the netatop source code:

cd /usr/src/ && sudo wget https://www.atoptool.nl/download/netatop-3.2.2.tar.gz

Extract the source code and enter the directory:

sudo tar -zxvf netatop-3.2.2.tar.gz && cd netatop-3.2.2

Build and install the module:
```
sudo make && sudo make install
```
Start the netatop service:
```
sudo systemctl start netatop
```

Verify that netatop is installed.

Run atop and press n. A NET column in the process list confirms success.

ATOP -                    7                    2025/09/17 15:04:49                    --------------------                    10s elapsed
PRC | sys    0.07s | user    0.07s |              |              | #proc    102 | #trun      1 | #tslpi   202 |         | #tslpu    40 | #zombie   0 | clones     4 |              | #exit      0
CPU | sys       1% | user       1% |              | irq       1% |              |              | idle     198% | wait   0% | steal      0% |              | guest      0% |              | curf 2.50GHz
cpu | sys       0% | user       0% |              | irq          0% |              |              | idle      99% | cpu000 w | steal      0% |              | guest      0% |              | curf 2.50GHz
cpu | sys       0% | user       1% |              | irq          0% |              |              | idle      99% | cpu001 w | steal      0% |              | guest      0% |              | curf 2.50GHz
CPL | avg1    0.01 |              | avg5     0.03 | avg15    0.04 |              |              | csw     43494 |          | intr    22870 |              |              |              | numcpu       2
MEM | tot     1.9G | free   240.7M | cache    1.1G | dirty    0.3M | buff    51.8M | slab  104.4M | slrec  69.4M | shmem  2.0M | shrss      | shswp  0.0M |              | vmcom 728.4M |              | vmlim 952.1M
SWP | tot     0.0M |              | free     0.0M | swcac    0.0M |              |              |              |              |              |              |              |              |              |
DSK |    vda       | busy       0% | read       0 | write      4 |              | discrd     0 | KiB/r        | KiB/w    19 | KiB/d        | MBr/s    0 | MBw/s      0 |              | avq     0.50 | avio 0.0 ms
NET | transport    | tcpi      89  | tcpo     131 | udpi         |              | udpo      13 | tcpao      9 | tcppo      0 | tcprs        | tcpie        |              |              | udpnp        |
NET | network     | ipi      102  |              | ipo      108 | ipfrw      0 |              | deliv    102 |              |              | coll       0 | mlti       0 | erro         | icmpo        |
NET | eth0   ---- | pcki     108  | pcko     110 |              | sp   0 Mbps  | si   17 Kbps | so   66 Kbps |              |              |              |              |              |              |
  PID        TID      TCPRCV     TCPRASZ     TCPSND     TCPSASZ      UDPRCV     UDPRASZ      UDPSND     UDPSASZ      BANDWI      BANDWO        NET    CMD  1/1
 6605          -          38         193         33        1569           4         205           4         126       6 Kbps      41 Kbps        57%
 6660          -          25         183         33         676           5         204           5         106       4 Kbps      18 Kbps        27%
 7429          -          12         507         17         125           4         142           4         101       5 Kbps       2 Kbps         9%
 1588          -          10          70         10         396           0           0           0           0       0 Kbps       3 Kbps         4%
 1179          -           4          58          2        1792           0           0           0           0       0 Kbps       2 Kbps         4%
 1201          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 7486          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
17891          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 7539          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 2116          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  641          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 7157          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 1108          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  979          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  652          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
   11          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
   12          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
   29          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
   31          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
   90          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  129          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  130          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  157          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
  352          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 7107          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 7186          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
 7631          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%
17612          -           0           0          0           0           0           0           0           0       0 Kbps       0 Kbps         0%

Why can't I view the historical processes that caused the fault after restarting my ECS instance?
By default, Linux does not record process-level historical resource usage, and restarting releases process information from memory. Without a monitoring tool installed beforehand, you cannot trace back to the fault scene before the restart, including issues such as system hangs, out-of-memory (OOM) errors, high kswapd0 load, and full I/O saturation.
To be able to locate the root cause through historical logs when the next fault occurs, complete the following configuration in advance:
Install atop as described in this topic and enable auto-start on boot (sudo systemctl enable atop) to ensure that atop continuously records process snapshots after the instance restarts. After configuration, when the next fault occurs, load historical logs with atop -r /var/log/atop/atop_YYYYMMDD to locate the root cause.

Elastic Compute Service:Monitor Linux metrics with atop

Install atop

Alibaba Cloud Linux 4/3/2, CentOS 7/8, or Fedora

Ubuntu or Debian

CentOS Stream 9 or Rocky Linux 9

openSUSE

View real-time metrics

View historical metrics

Read historical logs

Configure logging behavior

Generate metric reports

Examples

atopsar command syntax

Metric reference

System resource overview

Process-level details

Apply in production

FAQ

Why do I get the error `stat raw file: No such file or directory` when running `atop -r`?

How can I reduce `atop`'s disk space usage?

Why can't I see per-process network traffic when I press the `n` key in atop's interactive mode?

Why can't I view the historical processes that caused the fault after restarting my ECS instance?

Install atop

Alibaba Cloud Linux 4/3/2, CentOS 7/8, or Fedora

Ubuntu or Debian

CentOS Stream 9 or Rocky Linux 9

openSUSE

View real-time metrics

View historical metrics

Read historical logs

Configure logging behavior

Generate metric reports

Examples

atopsar command syntax

Metric reference

System resource overview

Process-level details

Apply in production

FAQ

Why do I get the error stat raw file: No such file or directory when running atop -r?

How can I reduce atop's disk space usage?

Why can't I see per-process network traffic when I press the n key in atop's interactive mode?

Why can't I view the historical processes that caused the fault after restarting my ECS instance?

Why do I get the error `stat raw file: No such file or directory` when running `atop -r`?

How can I reduce `atop`'s disk space usage?

Why can't I see per-process network traffic when I press the `n` key in atop's interactive mode?