atop is an interactive system and process monitor for Linux. It shows CPU, memory, disk, and network activity—plus a per‑process view—similar in spirit to top, but with richer system-level detail and the ability (when enabled) to read historical samples from log files.
Package names vary by distro, but it’s usually just atop.
# Debian/Ubuntu sudo apt update sudo apt install atop # RHEL/CentOS/Fedora (package manager differs by version) sudo dnf install atop # or: sudo yum install atop # Arch sudo pacman -S atop
Start it with: atop. You’ll get a live dashboard that refreshes periodically. You can usually press h for built-in help and q to quit.
Think of atop as two layers:
When a machine “feels slow,” your goal is usually to answer: which resource is saturated, and which processes are responsible? atop helps you do both in one place.
1) Start atop with a faster refresh interval
liveRefresh every 2 seconds (instead of the default).
atop 2
Use when: you’re chasing short spikes (CPU bursts, I/O bursts) and want snappier updates.
2) Run atop for a limited duration and write a capture file
recordCapture 10 minutes of samples at 10-second intervals (creates a raw capture file you can replay).
sudo atop -w /tmp/atop-capture.raw 10 60
Use when: you need evidence for later analysis or to share with someone (e.g., “it spiked at 3:14am”).
3) Replay a recorded capture file
replayOpen a saved recording and “time travel” through it.
sudo atop -r /tmp/atop-capture.raw
Use when: the issue already happened and you want to inspect it calmly, step by step.
4) Record to a plain-text report (batch mode)
reportWrite a human-readable snapshot report to a file (handy for tickets and email).
sudo atop -b -n 1 > /tmp/atop-report.txt
Use when: you want a quick “what did the box look like?” report without interactive UI.
5) Show only processes for a specific user
filterFocus on a single account’s workload (helpful on shared systems).
sudo atop -u www-data
Use when: you’re debugging “the web user is pegging the CPU” or “a cron user is flooding disk I/O.”
6) Watch disk I/O pressure and the processes causing it
diagnoseStart atop, then switch to an I/O-focused view and sort by disk usage.
atop # then in atop: press 'd' (disk) and/or sort by I/O columns (often 'O' or shown in help) # press 'h' for exact keybindings on your build
Use when: load is high but CPU isn’t—often the box is waiting on disk reads/writes.
7) Find memory hogs (RSS/VSZ) and swap churn
diagnoseStart atop and switch to memory-focused sorting.
atop # look at memory/swap in the system summary # then sort the process list by memory (RSS) or virtual size (VSZ) (check 'h' for your keys)
Use when: the box is paging, swap is climbing, or you suspect a leak.
8) Focus on a single PID
targetTrack one process closely (works best if you already know the PID).
sudo atop -p 12345
Use when: you’re profiling a known “suspect” process (database, JVM, backup job, etc.).
9) Narrow the view to specific process names (pattern matching)
filterUseful when you have many similar processes (e.g., workers) and want only one family.
# Example: show only processes with "nginx" in the command line (approach varies by distro/build) # One simple way is to use atop + interactive search/filter (press 'h' for your keys), # or use a quick shell filter for batch reports: sudo atop -b -n 1 | grep -i nginx
Use when: you want a “focused report” without scrolling through every process.
10) Read historical atop logs (if your distro records them)
historyMany systems store daily atop logs under /var/log/atop/.
# List available log files (typical location) ls -lh /var/log/atop/ # Replay a specific day's log (example filename pattern; yours may differ) sudo atop -r /var/log/atop/atop_YYYYMMDD
Use when: “it happened overnight” and you want to reconstruct what the system was doing.
Keybindings can vary a bit by build, but these are common patterns. If in doubt, press h inside atop.
If you’d like, tell me your distro (Ubuntu, Debian, Fedora, etc.) and whether you want dark mode, a left sidebar, or a multi-page layout—and I’ll generate a matching “site style” template you can reuse for other commands.