NETATOPD(8)

NAME
netatopd - log network statistics of finished processes

DESCRIPTION
This manual page documents the netatopd daemon. This daemon reads the counters of exited processes delivered by the netatop module and writes the counters to a logfile.

The 'usual' state of this daemon is the getsockopt() command NETATOP_GETCNT_EXIT. With this command, netatopd blocks until an exited task is available on the exitlist of the netatop module. The obtained netpertask struct that countains the counters of an exited process is written to a logfile (similar to the process accounting info provided by the base kernel itself). The daeon stops logging when there is only 5% of free space left in the filesystem of the logfile.

The logfile starts with a small header struct that contains a.o. a sequence number indicating how many netpertask structs are currently logged. This header is mmapped and can be consulted by analysis processes like atop that consult the logfile. Behind the header, the netpertask structs can be found in compressed form. Every compressed netpertask struct is preceeded by one byte specifying the size of the compressed netpertask struct.

Before an analysis process starts using the logfile, it has to subscribe itself by decrementing a semaphore owned by the netatopd daemon. In this way, netatopd knows how many analysis processes are currently using the logfile. When no processes use the logfile any more, netatopd truncates the logfile and start building a new one as soon as a new subscription of an analysis process is noticed.

FILES

/var/run/netatop.log
    File in which netatopd writes the compressed accounting records about processes that have finished.

SEE ALSO
netatop(4), atop(1), atopsar(1), atoprc(5)
https://www.atoptool.nl

AUTHOR
Gerlof Langeveld (gerlof.langeveld@atoptool.nl)