Analizar logs de atop con awk

Un sencillo script awk que analiza los logs de atop. A partir de aquí, el cielo es el límite 😉 (por ejemplo, adaptar la salida para generar gráficas con gnuplot)

#!/bin/bash
# Example of how to easily parse atop logs with awk
# You can adapt this to generate plots based on atop logs

# First collect the output of atop for each relevant file. For example:
#   for f in $(ls /var/log/atop/atop_2015*); do atop -r $f >> atop_collection; done
# Then pass that file (atop_collection) as stdin to this script
grep -v "^NET" - | awk 'BEGIN{summary=""; i=0}
                       /^ATOP/ {timestamp=$4 "-" $5; print timestamp " SYS " sys " USR " user " IRQ " irq " IDLE " idle " FREE " freemem " CACHE " cache; j=0; for (p in processes){print processes[j++]}; i=0; delete processes; next}
                       /^CPU/ {sys=$4; user=$7; irq= $10; idle=$13; next}
                       /^MEM/ {freemem=$7; cache=$10; next}
                       $1 ~ /[0-9]+/ {cpu=$11; sub(/%/,"",cpu); if(cpu+0 > 20){processes[i]=$0; i++}; next}
                       '

A partir del script anterior, se puede crear uno que resuma el consumo de memoria de cada comando:

#!/bin/bash
egrep -vi "^cpu|^mem|^atop|^prc|^swp|^pag|^net|^cpl|^  pid" - | grep -v 'since boot'  | awk 'BEGIN{summary=""; i=0}
{vsize_raw=$5; rsize_raw=$6; cmd=$10;
 
 vs_unit=substr(vsize_raw,length(vsize_raw),1);
 vsize=substr(vsize_raw,1,length(vsize_raw)-1);

 if(vs_unit == "M"){ vsize_scaled=vsize; }
 else if(vs_unit == "G") {vsize_scaled=vsize * 1024;}
 else {vsize_scaled=0};

 if(vsize_scaled > 300){
    if(vsizes[cmd] < vsize_scaled) vsizes[cmd] = vsize_scaled;
 }

 rs_unit=substr(rsize_raw,length(rsize_raw),1);
 rsize=substr(rsize_raw,1,length(rsize_raw)-1);

 if(rs_unit == "M"){ rsize_scaled=rsize; }
 else if(rs_unit == "G") {rsize_scaled=rsize * 1024;}
 else {rsize_scaled=0};

 if(rsize_scaled > 300){
    if(rsizes[cmd] < rsize_scaled) rsizes[cmd] = rsize_scaled;
 }

}END{
  for (k in vsizes){
      print k " " vsizes[k] " " rsizes[k];
  }
}'

A este script se le puede pasar directamente la salida de atop:

for f in $(ls /var/log/atop/atop_2015*); do atop -m -r $f; done | ./basic-atop-filter-cmd-mem