> ## Documentation Index > Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # filetrace processes: network activity per process > Reference for filetrace processes: outbound rate, files sent, open connections and byte totals per process, with every option, examples and exit codes. `filetrace processes` lists the processes with network activity: how fast each is sending now, how many distinct files it has sent, how many connections it has open and how many bytes it has sent and received. Rows are ordered by outbound rate, then by bytes sent, so the processes sending now come first. ## Usage ```bash theme={null} filetrace processes [options] ``` ## What it shows ```bash theme={null} sudo filetrace processes --limit 8 ``` ```text theme={null} PID PROCESS OUTBOUND FILES CONNECTIONS SENT RECEIVED 1024 file-server 4.04 MB/s 1 2 15.5 MB 0 B 1014 file-server 0 B/s 1 0 47.7 MB 0 B 1018 file-server 0 B/s 1 0 11.4 MB 0 B 1016 file-server 0 B/s 1 0 7.63 MB 0 B 1020 file-server 0 B/s 0 0 195 KB 6 B 1022 file-server 0 B/s 0 1 48.8 KB 0 B 152 metrics-daemon 0 B/s 0 1 473 B 0 B 1021 file-server 0 B/s 0 0 6 B 195 KB Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` | Column | Meaning | | - | - | | PID | The process ID | | PROCESS | The process name | | OUTBOUND | The rate at which the process is sending now, in bytes per second over the last one to two seconds | | FILES | The distinct files it has sent; a file sent over several sockets counts once | | CONNECTIONS | Its open sockets | | SENT | Bytes its sockets accepted since the agent started observing it | | RECEIVED | Bytes its sockets delivered to it | A process is listed once it has sent or received bytes or holds an open socket. Processes that have exited stay listed while the agent remembers them; machine-readable output gives their `status` as `exited`. ## Options **--active-only** `boolean` Only running processes with at least one open connection. **--include-children** `boolean` Add each process's descendants to its totals: bytes, rates, connections, files and transfers. **--pid** `number` Only this process. **--process** `string` Only processes with this name. `*` matches any run of characters. Alias: `--name`. **--user** `string` Only processes of this user, by name or numeric ID. **--cgroup** `string` Only processes in this cgroup, by numeric ID or cgroup directory. **--namespace** `number` Only processes in this network, PID or mount namespace, given as the inode number that `ls -Li /proc//ns` shows. **--since** `string` Only processes active at or after this time: a duration such as `10m`, `1h` or `7d`, or an RFC 3339 timestamp. **--until** `string` Only processes that started at or before this time. **--sort** `string` `outbound`, `inbound`, `connections`, `bytes`, `time`, `pid` or `process`. `outbound` and `inbound` order by the current rate, then by bytes; `bytes` orders by bytes sent and received together; `time` by the most recent activity. **--limit** `number` Show at most this many rows. **--format** `string` (default: table) `table`, `json`, `jsonl`, `csv` or `quiet`. Quiet prints one process ID per row. **--json** `boolean` Short for `--format json`. **--jsonl** `boolean` Short for `--format jsonl`. **--output** `string` Write to this file instead of standard output. Byte counts cover a record's whole observed lifetime; `--since` and `--until` select which records are listed. See [filters](https://filetrace.mintlify.site/cli/filters.md) and [output formats](https://filetrace.mintlify.site/cli/output-formats.md). ## Examples ```bash theme={null} filetrace processes --sort outbound filetrace processes --name nginx --include-children filetrace processes --format csv > processes.csv ``` Machine-readable output adds the parent, user, executable, transfer counts, start time, status, cgroup and namespaces of each process: ```bash theme={null} sudo filetrace processes --json --limit 2 ``` ```json theme={null} [ {"pid":1024,"ppid":772,"name":"file-server","user":"root","uid":0,"gid":0,"executable":"/usr/local/bin/file-server","bytes_sent":16250000,"bytes_received":0,"bytes_sent_per_second":4227370,"bytes_received_per_second":0,"connections":2,"files":1,"transfers":1,"active_transfers":1,"started":"2026-11-11T20:07:56.180Z","status":"running","cgroup_id":631,"pid_namespace":4026531836,"mount_namespace":4026532557,"network_namespace":4026532561}, {"pid":1014,"ppid":772,"name":"file-server","user":"root","uid":0,"gid":0,"executable":"/usr/local/bin/file-server","bytes_sent":50000000,"bytes_received":0,"bytes_sent_per_second":0,"bytes_received_per_second":0,"connections":0,"files":1,"transfers":1,"active_transfers":1,"started":"2026-11-11T20:07:56.052Z","status":"exited","cgroup_id":631,"pid_namespace":4026531836,"mount_namespace":4026532557,"network_namespace":4026532561} ] ``` To see one process in full, with its top destinations and the files it sent, use [`inspect process`](https://filetrace.mintlify.site/cli/inspect). [`top`](https://filetrace.mintlify.site/cli/top) ranks the processes by outbound traffic. ## Exit codes | Code | Meaning | | - | - | | 0 | Success | | 1 | General error | | 2 | Invalid arguments | | 3 | Permission denied: the agent socket is not accessible to this user | | 4 | No agent is running | | 5 | Unsupported platform or capability | | 6 | The configuration file cannot be read or is invalid | | 9 | Partial results: events were lost in the queried time range | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.