Top Ten Tops I<M@<NJ Y\e`Z\#=fkfc`X N\g`Zbk_\kfgk\eKfgkffcj KFG:FEK<E;<IJ The famous Unix admin utility known as Top has many imitators. We take a look at some of the top Top tools. BY MARKUS FEILNER AND SASCHA SPREITZER eak loads, I/ O issues, and inex- The top tools in this category – with [2] to query information on the clients plicable system behavior pose one exception – all have one thing in connected to the X server. The XRes- Gproblems for administrators day common: They display the resources QueryClients, XResQueryClientResources, after day. Why is the database using so used by a service or a server in a syntax and XresQueryClientPixmapBytes func- much swap memory? Why is my laptop that is reminiscent of the legendary Unix tions provide the data from which battery discharging so quickly? The leg- Top utility. The rankings here are based Xrestop generates a Top-style view. acy command-line utility Top specializes on how useful the tool is for trouble- Xrestop was originally designed by the in problems like these. shooting. X.org community to help developers lo- Top was the first in a long line of self- cate memory or performance holes in refreshing resource monitoring tools. ('1Oi\jkfg the X server, but in the course of time, it Now numerous imitators vie for the ad- Xrestop [1] shows X11 users which X has gained popularity as a daily adminis- ministrator’s attention. With the help of client programs are using the most re- tration tool. Admins today often use a Linux Magazine jury, we tried out doz- sources, organizing the results neatly by Xrestop to locate undesirable resource ens of wannabe top performers, and now pixmap memory usage (Figure 1). The killers. Although you can locate a proudly present the top 10 Tops. tool relies on the X resource extension crashed or hanging X Window applica- DECEMBER 2008 ISSUE 97 45 045-049_toptools.indd 45 16.10.2008 16:50:02 Uhr I<M@<NJ Top Ten Tops cent versions of Ntop. According to Ntop developer Luca Deri, the next version of Ntop will include the far more compre- hensive Packet Shell (Pksh [4]). But until it is released, Ntop does not offer a com- mand-line client. Thus, despite its enormous feature set, the excellent web interface, and the scope of the information it collects, Ntop comes in at number nine. /18gXZ_\Kfg =`^li\(1Oi\jkfgj_fnjk_\g`odXgd\dfipljX^\]fik_\XZk`m\O((Xggc`ZXk`fej%K_\ ApacheTop [5] is a lean tool that offers jZi\\ej_fknXjkXb\en`k_BJeXgj_fk#n_`Z_\ogcX`ejn_pk_\BJeXgj_fkkffc`jfekfgf] information on current Apache web k_\c`jk% server access, the pages Apache serves up, the number of hits per second, and tion easily, you will need to use another The tool shows the admin details of many other statistics. The helper appli- tool to kill the culprit. Because Xrestop network connections on an interface, cation finds the necessary information in only helps you troubleshoot issues with sorting them by time, host, protocol, or Apache’s access_log files (Figure 3). X applications and does not offer much various other options. Clear RRD-based Some options change the appearance in the line of options, the tool just diagrams give administrators an at-a- of the queries: -q keeps the query strings scrapes into 10th place on the list. glance view of unusual goings on. used by, for example, PHP scripts, -l Although you don’t need to customize forces lower case, and -s number defines 01Ekfg Ntop before you start, the information it the number of numeric sections in the Ntop [3] is a popular instant monitoring collects is volatile and disappears com- URL. Finally, -r resolves host names to tool that gives the admin an overview of pletely if you restart. A workaround for their matching IPs. the network interface card, its through- this is to use Ntop with a database back A web administrator can use the com- put, and all of its connections. The mass end, although this solution will entail far mand line to tell ApacheTop how long to of information that Ntop collects and more configuration. keep statistics before refreshing and de- presents in its neat web interface guar- Until recently, Ntop also included the leting them. To do this, you can define a antees a top 10 spot for the 10-year-old Intop command-line tool, which displays number of hits (-H Hits) or specify a Ntop project. Figure 2 shows just some a continually updated Top-style view of value in seconds (-T seconds), as well as of the statistics that Ntop collects. the current network connections. The set the delay between two refreshes (-d Intop tool, however, is missing from re- seconds). Table 1: Ptop Shortcuts Q Shows the query for a PID entry. E The query plan for the PID. The PostgreSQL EXPLAIN and EX- PLAIN_ANALYZE functions are used for this (Figure 4). L Shows locks. R Shows statistics (Figure 5). X Shows index data. Table 2: Dnstop Shortcuts S Shows the query source. D The target; that is, the DNS server used. T Shows a list of DNS query types sent by the machine. O The opcodes. Under normal cir- cumstances you will only see query-type lines here. 1, 2, 3 Allows the administrator to ex- tend the view in the server list to top-level, second-level, and third-level domain names, re- spectively. Ctrl+R Resets the counter. =`^li\)18kn_Xkk`d\`jk_\MGEj\im\iYlj`\jk6EkfgXejn\ijk_`jhl\jk`feXe[dfi\n`k_ Ctrl+X Quits the program. `kje\Xkn\Y`ek\i]XZ\% 46 ISSUE 97 DECEMBER 2008 045-049_toptools.indd 46 16.10.2008 16:50:03 Uhr Top Ten Tops I<M@<NJ but with a complete third-level domain name (Figure 6). If you use Dnstop on a router, you can also detect undesirable DNS tunnels. A client on a local network that exchanges a large volume of data via a DNS server will be exposed quickly. ,1@]kfg Snapshots and a traffic overview for all active network connections are Iftop’s [9] specialty. Just like Top, it sorts con- nections by activity and offers a jam- =`^li\*18n\Yj\im\ile[\i`em\jk`^Xk`feYp8gXZ_\Kfg18lj\i`jZlii\ekcpXZZ\jj`e^ packed action set while doing so (see Jhl`ii\cDX`c% Figure 7). Administrators can press H to view on- The tool loses a couple points because To launch Ptop, enter pg_top -d data- line help and configure the view. it is fairly ancient and has not been de- base -U database_user -W password. The Throughput is not only displayed as a veloped actively since 2005. Despite the command takes the user to an interac- figure, but also by a bar chart. Iftop ad- drawbacks, administrators who have in- tive shell, where a number of shortcuts justs the scale at the top of the screen to stalled Fam and Portmap on their web are available (Table 1). reflect the amount of bandwidth used. servers will find ApacheTop a practical Ptop is available for Linux, BSD, and Various options allow users to disable live analysis tool for Apache, with many Mac OS. For more screenshots and de- DNS name resolution, hide sources and applications in production use. tails, go to the website [7]. targets, and sort on various columns. At Unfortunately, the feature scope is re- the bottom edge of the display, you can stricted to command-line options, which -1;ejkfg see the average and accumulated values makes it hard for ApacheTop to keep Dnstop [8] uses the Pcap library to filter and sums for the Ethernet device sorted pace with some of its more feature-rich all the DNS queries on a computer’s net- by input and output. competitors. work interface and list them neatly. The The comprehensive filtering options dnstop network_device -t -s command are really exciting for network adminis- .1Gkfg gives you a list of DNS queries in a Top- trators and can be entered either in inter- Two database tools appear in the top 10. style, configurable view. Table 2 shows active mode (after entering iftop -f op- At seventh place is Ptop [6] (see Figure some Dnstop shortcuts. tions) or by pressing the F key. For exam- 4). Any administrator who has worked When you enter a question mark, ?, ple, -f icmp displays ICMP packages only. with PostgreSQL will be interested in Dnstop displays the integrated online The familiar Tcpdump style can be in- this tool because Ptop provides an over- help. At the same time, Dnstop offers verted by making a selection – for exam- view of all your database processes, at two combined views that give users sev- ple: not port ssh. the same time displaying information eral pieces of information at a glance. The -F option tells Iftop to automati- such as the SQL statements currently The @ entry lets you display the source cally filter out individual hosts, or com- being processed. But that’s not all: Ptop of the query along with the second-level plete networks, leaving only those that also gives you details of locks and statis- domain target-side, along with the vol- match the selected network mask: iftop tics for individual tables and indices ume and percentage of all DNS traffic. -F 192.168.0.0/24 is an example for a (Figure 5). The # option gives you the same results, local network. For more information on =`^li\+1Gkfg^`m\jpfl[\kX`cjf]cfZbjXe[jkXk`jk`Zj]fi`e[`m`[lXc =`^li\,1GkfgËjIfgk`fe^`m\jpfljkXk`jk`Zj#`eZcl[`e^[\kX`cjc`b\ kXYc\jXe[`e[`Z\j%Gkfgn`cc^`m\pflk_\hl\ipgcXe]fiXepZlii\ekcp k_\eldY\if]j\hl\ek`Xci\X[jXe[ni`k\j]ifdXe[kfk_\Gfjk$ XZk`m\hl\ip#gifm`[`e^pfljk`glcXk\<]fi<OGC8@E% ^i\JHCkXYc\% DECEMBER 2008 ISSUE 97 47 045-049_toptools.indd 47 16.10.2008 16:50:04 Uhr I<M@<NJ Top Ten Tops to discover the MySQL statement behind a selected thread.