filetrace top ranks what sends the most: processes (the default), files, remote addresses or connections. It prints the ten highest by default, numbered by rank, and takes the same time filters as the listing commands.
Usage
Subjects
In a table, a heading line names the ranking, such as
TOP PROCESSES BY OUTBOUND TRAFFIC, and the first column is the RANK.
Processes
processes.
Files
sendfile and once by a read-write loop shows INFERRED. Bytes that no file accounts for are not ranked. A file whose path is not known shows as (device <n> inode <n>).
Destinations
* collects flows without a remote end, such as a UDP socket that only receives.
Connections
flows; FLOW is the ID that inspect flow takes.
Options
number
Only this process.
string
Only processes with this name.
* matches any run of characters. Alias: --name.string
default:"all"
Only this protocol:
tcp, udp or all. Accepted by the files, destinations and connections subjects; top processes does not take it.string
Only records active at or after this time: a duration such as
10m, 1h or 7d, or an RFC 3339 timestamp.string
Only records that started at or before this time.
number
default:"10"
Number of rows.
string
default:"table"
table, json, jsonl, csv or quiet. Quiet prints the process ID, file path, remote address or flow ID of each row, depending on the subject.boolean
Short for
--format json.boolean
Short for
--format jsonl.string
Write to this file instead of standard output. The heading line is left out.
--since and --until select which records are ranked. Machine-readable formats carry exact byte counts and RFC 3339 timestamps, and leave out the rank: the order of the records is the ranking. For files the fields are file, bytes_sent, transfers and confidence; for destinations they are remote_ip, bytes_sent, bytes_received and flows; processes and connections print the records of processes and flows.