live

Display live system data interactively. This subcommand supports the following options:

-i, --interval-s <INTERVAL_S>

Set the refresh interval in seconds. Default is 5 seconds.

-s, --host <HOST>

Supply hostname to activate remote viewing.

--port <PORT>

Override the default port to connect remote viewing to.

record

Record local system data in daemon mode for later analysis. This subcommand supports the following options:

-i, --interval-s <INTERVAL_S>

Set the data collection interval in seconds. Default is 5 seconds.

--retain-for-s <RETAIN_FOR_S>

Specify retention period in seconds. Data is stored in 24-hour shards. Shards older than RETAIN_FOR_S + 24 hours are discarded.

--store-size-limit <STORE_SIZE_LIMIT>

Set the maximum storage size in bytes. Data is stored in 24-hour shards, and the oldest shards are deleted first.

--collect-io-stat

Enable collection of io.stat for cgroups. This may be resource-intensive.

--port <PORT>

Override the default port for the remote viewing server.

--skew-detection-threshold-ms <SKEW_DETECTION_THRESHOLD_MS>

Set the threshold (in milliseconds) for detecting skew in data collection. Default is 500ms.

--disable-disk-stat

Disable collection of disk statistics.

--disable-exitstats

Disable eBPF-based exit statistics.

--compress

Enable zstd compression for data files. Expect approximately 10x smaller files.

--dict-compress-chunk-size <DICT_COMPRESS_CHUNK_SIZE>

Specify chunk size for zstd dictionary compression. Must be a power of 2, between 2 and 32768.

replay

Replay historical data interactively. This subcommand supports the following options:

-t, --time <TIME>

Time string specifying the replay starting point. Examples:

-s, --host <HOST>

Supply hostname to activate remote viewing.

--port <PORT>

Override the default port to connect remote viewing to.

-r <YESTERDAYS>

Days adjuster. Use y for yesterday, repeated as needed (e.g., yy for 2 days ago). Examples:

--snapshot <SNAPSHOT>

Replay from a snapshot file generated by the snapshot command instead of from the store directory.

debug

Provide debugging facilities. This subcommand includes the following subcommands:

dump-store

Dump the data store for debugging purposes. This subcommand supports the following options:

convert-store

Convert frames from an existing store and write them to a new store. This can be used to test compression or serialization formats. This subcommand supports the following options:

dump

Dump historical data into parseable text format. Subcommands:

system

Dump system stats

disk

Dump disk stats

btrfs

Dump btrfs Stats

process

Dump process stats

cgroup

Dump cgroup stats

iface

Dump the link layer iface stats

network

Dump the network layer stats including ip and icmp

transport

Dump the transport layer stats including tcp and udp

ethtool-queue

Dump network interface queue stats

tc

Dump the tc related stats with qdiscs

dump system

Dump system stats.

Available fields

timestamp, datetime, hostname, kernel_version, os_release, stat.total_interrupt_ct, stat.context_switches, stat.boot_time_epoch_secs, stat.total_processes, stat.running_processes, stat.blocked_processes, cpu.idx, cpu.usage_pct, cpu.user_pct, cpu.system_pct, cpu.idle_pct, cpu.nice_pct, cpu.iowait_pct, cpu.irq_pct, cpu.softirq_pct, cpu.stolen_pct, cpu.guest_pct, cpu.guest_nice_pct, cpus.<key>.idx, cpus.<key>.usage_pct, cpus.<key>.user_pct, cpus.<key>.system_pct, cpus.<key>.idle_pct, cpus.<key>.nice_pct, cpus.<key>.iowait_pct, cpus.<key>.irq_pct, cpus.<key>.softirq_pct, cpus.<key>.stolen_pct, cpus.<key>.guest_pct, cpus.<key>.guest_nice_pct, mem.total, mem.free, mem.available, mem.buffers, mem.cached, mem.swap_cached, mem.active, mem.inactive, mem.anon, mem.file, mem.unevictable, mem.mlocked, mem.swap_total, mem.swap_free, mem.dirty, mem.writeback, mem.anon_pages, mem.mapped, mem.shmem, mem.kreclaimable, mem.slab, mem.slab_reclaimable, mem.slab_unreclaimable, mem.kernel_stack, mem.page_tables, mem.anon_huge_pages_bytes, mem.shmem_huge_pages_bytes, mem.file_huge_pages_bytes, mem.hugetlb, mem.cma_total, mem.cma_free, mem.vmalloc_total, mem.vmalloc_used, mem.vmalloc_chunk, mem.direct_map4k, mem.direct_map2m, mem.direct_map1g, vm.pgpgin_per_sec, vm.pgpgout_per_sec, vm.pswpin_per_sec, vm.pswpout_per_sec, vm.pgsteal_kswapd, vm.pgsteal_direct, vm.pgscan_kswapd, vm.pgscan_direct, vm.oom_kill, slab.<idx>.name, slab.<idx>.active_objs, slab.<idx>.num_objs, slab.<idx>.obj_size, slab.<idx>.obj_per_slab, slab.<idx>.num_slabs, slab.<idx>.active_caches, slab.<idx>.num_caches, slab.<idx>.active_size, slab.<idx>.total_size, ksm.advisor_max_cpu, ksm.advisor_max_pages_to_scan, ksm.advisor_min_pages_to_scan, ksm.advisor_mode, ksm.advisor_target_scan_time, ksm.full_scans, ksm.general_profit, ksm.ksm_zero_pages, ksm.max_page_sharing, ksm.merge_across_nodes, ksm.pages_scanned, ksm.pages_shared, ksm.pages_sharing, ksm.pages_skipped, ksm.pages_to_scan, ksm.pages_unshared, ksm.pages_volatile, ksm.run, ksm.sleep_millisecs, ksm.smart_scan, ksm.stable_node_chains, ksm.stable_node_chains_prune_millisecs, ksm.stable_node_dups, ksm.use_zero_pages, disks.<key>.name, disks.<key>.disk_usage, disks.<key>.partition_size, disks.<key>.filesystem_type, disks.<key>.read_bytes_per_sec, disks.<key>.write_bytes_per_sec, disks.<key>.discard_bytes_per_sec, disks.<key>.disk_total_bytes_per_sec, disks.<key>.read_completed, disks.<key>.read_merged, disks.<key>.read_sectors, disks.<key>.time_spend_read_ms, disks.<key>.write_completed, disks.<key>.write_merged, disks.<key>.write_sectors, disks.<key>.time_spend_write_ms, disks.<key>.discard_completed, disks.<key>.discard_merged, disks.<key>.discard_sectors, disks.<key>.time_spend_discard_ms, disks.<key>.major, disks.<key>.minor, btrfs.<key>.name btrfs.<key>.disk_fraction, btrfs.<key>.disk_bytes

Aggregated fields

cpu: includes [cpu.usage_pct, cpu.user_pct, cpu.system_pct].

mem: includes [mem.total, mem.free].

vm: includes [vm.pgpgin_per_sec, vm.pgpgout_per_sec, vm.pswpin_per_sec, vm.pswpout_per_sec, vm.pgsteal_kswapd, vm.pgsteal_direct, vm.pgscan_kswapd, vm.pgscan_direct, vm.oom_kill].

stat: includes [stat.total_interrupt_ct, stat.context_switches, stat.boot_time_epoch_secs, stat.total_processes, stat.running_processes, stat.blocked_processes].

--detail: includes [<agg_field>.*] for each given aggregated field.

--default: includes [hostname, datetime, cpu, mem, vm, kernel_version, os_release, stat, timestamp].

--everything: includes everything (equivalent to --default --detail).

OPTIONS

-f, --fields <FIELDS>... Select which fields to display and in what order.

--default Show all top layer fields. If --default is specified, it overrides any specified fields via --fields.

--everything Show all fields. If --everything is specified, --fields and --default are overridden.

-d, --detail Show more information other than default.

-b, --begin <BEGIN> Begin time, same format as replay.

-e, --end <END> End time, same format as replay.

--duration <DURATION> Time string specifying the duration, e.g., "10 min." Keywords: days min, h, sec. Relative: {humantime}, e.g., "2 days 3 hr 15m 10sec."

-F, --filter <FILTER> Take a regex and apply it to --select selected field. See command level doc for example.

--sort Sort (lower to higher) by --select selected field. See command level doc for example.

--rsort Sort (higher to lower) by --select selected field. See command level doc for example.

--top <TOP> [default: 0].

--repeat-title <REPEAT_TITLE> Repeat title, for each N line, it will render a line of title. Only for raw output format.

-O, --output-format <OUTPUT_FORMAT> Output format. Choose from raw, csv, tsv, kv, json, openmetrics. Default to raw.

-o, --output <OUTPUT> Output destination, default to stdout.

--disable-title Disable title in raw, csv or tsv format output.

-r <YESTERDAYS> Days adjuster, same as -r option in replay.

--br <BR> Line break symbol between samples.

--raw Dump raw data without units or conversion.

-p, --pattern <PATTERN> Saved pattern in the dumprc file under [system] section.

Example Commands

$ below dump system -b "08:30:00" -e "08:30:30" -f datetime vm hostname -O csv

Usage

below dump system [OPTIONS] --begin <BEGIN>

dump disk

Dump disk stats

Available fields

timestamp, datetime, name, disk_usage, partition_size, filesystem_type, read_bytes_per_sec, write_bytes_per_sec, discard_bytes_per_sec, disk_total_bytes_per_sec, read_completed, read_merged, read_sectors, time_spend_read_ms, write_completed, write_merged, write_sectors, time_spend_write_ms, discard_completed, discard_merged, discard_sectors, time_spend_discard_ms, major, minor

Aggregated fields

read: includes [read_bytes_per_sec, read_completed, read_merged, read_sectors, time_spend_read_ms].

write: includes [write_bytes_per_sec, write_completed, write_merged, write_sectors, time_spend_write_ms].

discard: includes [discard_bytes_per_sec, discard_completed, discard_merged, discard_sectors, time_spend_discard_ms].

fs_info: includes [disk_usage, partition_size, filesystem_type].

--detail: no effect.

--default: includes [datetime, name, disk_total_bytes_per_sec, major, minor, read, write, discard, fs_info, timestamp].

--everything: includes everything (equivalent to --default --detail).

OPTIONS

-f, --fields <FIELDS>...

Select which fields to display and in what order.

--default

Show all top-layer fields. Overrides fields specified via --fields.

--everything

Show all fields. Overrides --fields and --default.

-d, --detail

Show more information beyond the default fields.

-b, --begin <BEGIN>

Specify the start time, in the same format as the replay command.

-e, --end <END>

Specify the end time, in the same format as the replay command.

--duration <DURATION>

Specify a duration using time strings (e.g., "10 min"). Supports keywords like "days", "min", "h", "sec" and relative times (e.g., "2 days 3 hr 15m 10sec").

-F, --filter <FILTER>

Apply a regex filter to the field specified by --select.

--sort

Sort in ascending order by the field specified with --select.

--rsort

Sort in descending order by the field specified with --select.

--top <TOP>

Display the top N results for each time slice. Default is 0 (show all).

--repeat-title <REPEAT_TITLE>

Repeat the title line every N lines in raw output format.

-O, --output-format <OUTPUT_FORMAT>

Specify the output format. Options are raw, csv, tsv, kv, json, and openmetrics. Defaults to raw.

-o, --output <OUTPUT>

Specify the output destination. Defaults to stdout.

--disable-title

Disable the title in raw, csv, or tsv format output.

-r <YESTERDAYS>

Adjust the day offset, similar to the -r option in the replay command.

--br <BR>

Specify the line break symbol between samples.

--raw

Dump raw data without units or conversions.

-s, --select <SELECT>

Specify a field for operations (used with --sort, --rsort, --filter, --top).

-p, --pattern <PATTERN>

Use a saved pattern from the dumprc file under the [disk] section.

Examples

Simple example:
$ below dump disk -b "08:30:00" -e "08:30:30" -f read write discard -O csv
Outputs disk statistics for all specified fields between 08:30:00 and 08:30:30.

Filter by name:
$ below dump disk -b "08:30:00" -e "08:30:30" -s name -F nvme0* -O json
Outputs stats for disks matching "nvme0*" in JSON format.

Top partitions by read speed:
$ below dump disk -b "08:30:00" -e "08:30:30" -s read_bytes_per_sec --rsort --top 5
Displays the top 5 partitions by read speed for each time slice.

dump btrfs

Dump Btrfs filesystem statistics.

Available fields

timestamp, datetime, name, disk_fraction, disk_bytes

Aggregated fields

usage: includes [disk_fraction, disk_bytes].

--detail: no effect.

--default: includes [datetime, name, disk_usage, timestamp].

--everything: includes everything (equivalent to --default --detail).

OPTIONS

-f, --fields <FIELDS>

Select which fields to display and in what order.

--default

Show all top-layer fields. Overrides fields specified via --fields.

--everything

Show all fields. Overrides --fields and --default.

-d, --detail

Show more information beyond the default fields.

-b, --begin <BEGIN>

Specify the start time, in the same format as the replay command.

-e, --end <END>

Specify the end time, in the same format as the replay command.

--duration <DURATION>

Specify a duration using time strings (e.g., "10 min"). Supports keywords like "days", "min", "h", "sec" and relative times (e.g., "2 days 3 hr 15m 10sec").

-F, --filter <FILTER>

Apply a regex filter to the field specified by --select.

--sort

Sort in ascending order by the field specified with --select.

--rsort

Sort in descending order by the field specified with --select.

--top <TOP>

Display the top N results for each time slice. Default is 0 (show all).

--repeat-title <REPEAT_TITLE>

Repeat the title line every N lines in raw output format.

-O, --output-format <OUTPUT_FORMAT>

Specify the output format. Options are raw, csv, tsv, kv, json, and openmetrics. Defaults to raw.

-o, --output <OUTPUT>

Specify the output destination. Defaults to stdout.

--disable-title

Disable the title in raw, csv, or tsv format output.

-r <YESTERDAYS>

Adjust the day offset, similar to the -r option in the replay command.

--br <BR>

Specify the line break symbol between samples.

--raw

Dump raw data without units or conversions.

-s, --select <SELECT>

Specify a field for operations (used with --sort, --rsort, --filter, --top).

-p, --pattern <PATTERN>

Use a saved pattern from the dumprc file under the [btrfs] section.

Examples

Simple example:
$ below dump btrfs -b "08:30:00" -e "08:30:30" -f usage -O csv
Outputs Btrfs usage statistics between 08:30:00 and 08:30:30.

Top subvolumes by disk bytes:
$ below dump btrfs -b "08:30:00" -e "08:30:30" -s disk_bytes --rsort --top 5
Displays the top 5 subvolumes by disk usage for each time slice.

dump process

Dump process statistics.

Available fields

timestamp, datetime, pid, ppid, ns_tgid, comm, state, uptime_secs, cgroup, io.rbytes_per_sec, io.wbytes_per_sec, io.rwbytes_per_sec, mem.minorfaults_per_sec, mem.majorfaults_per_sec, mem.rss_bytes, mem.vm_size, mem.lock, mem.pin, mem.anon, mem.file, mem.shmem, mem.pte, mem.swap, mem.huge_tlb, cpu.usage_pct, cpu.user_pct, cpu.system_pct, cpu.num_threads, cmdline, exe_path

Aggregated fields

cpu: includes [cpu.usage_pct].

mem: includes [mem.rss_bytes].

io: includes [io.rbytes_per_sec, io.wbytes_per_sec].

--detail: includes [<agg_field>.*] for each given aggregated field.

--default: includes [datetime, pid, ppid, comm, state, cpu, mem, io, uptime_secs, cgroup, timestamp, cmdline, exe_path].

--everything: includes everything (equivalent to --default --detail).

OPTIONS

-f, --fields <FIELDS>

Select which fields to display and in what order.

--default

Show all top-layer fields. Overrides fields specified via --fields.

--everything

Show all fields. Overrides --fields and --default.

-d, --detail

Show more information beyond the default fields.

-b, --begin <BEGIN>

Specify the start time, in the same format as the replay command.

-e, --end <END>

Specify the end time, in the same format as the replay command.

--duration <DURATION>

Specify a duration using time strings (e.g., "10 min"). Supports keywords like "days", "min", "h", "sec" and relative times (e.g., "2 days 3 hr 15m 10sec").

-F, --filter <FILTER>

Apply a regex filter to the field specified by --select.

--sort

Sort in ascending order by the field specified with --select.

--rsort

Sort in descending order by the field specified with --select.

--top <TOP>

Display the top N results for each time slice. Default is 0 (show all).

--repeat-title <REPEAT_TITLE>

Repeat the title line every N lines in raw output format.

-O, --output-format <OUTPUT_FORMAT>

Specify the output format. Options are raw, csv, tsv, kv, json, and openmetrics. Defaults to raw.

-o, --output <OUTPUT>

Specify the output destination. Defaults to stdout.

--disable-title

Disable the title in raw, csv, or tsv format output.

-r <YESTERDAYS>

Adjust the day offset, similar to the -r option in the replay command.

--br <BR>

Specify the line break symbol between samples.

--raw

Dump raw data without units or conversions.

-s, --select <SELECT>

Specify a field for operations (used with --sort, --rsort, --filter, --top).

-p, --pattern <PATTERN>

Use a saved pattern from the dumprc file under the [process] section.

Examples

Simple example:
$ below dump process -b "08:30:00" -e "08:30:30" -f comm cpu io.rwbytes_per_sec -O csv
Outputs process statistics for specified fields (command name, CPU usage, I/O) from 08:30:00 to 08:30:30 in CSV format.

Filter by process name:
$ below dump process -b "08:30:00" -e "08:30:30" -s comm -F below* -O json
Outputs statistics for processes matching "below*" in JSON format.

Top CPU-intensive processes:
$ below dump process -b "08:30:00" -e "08:30:30" -s cpu.usage_pct --rsort --top 5
Displays the top 5 processes by CPU usage for each time slice.

dump cgroup

Dump cgroup stats for specified time slices and fields.

Available fields

timestamp, datetime, name, full_path, inode_number, props.cgroup_controllers, props.cgroup_subtree_control, props.tids_max, props.memory_min, props.memory_low, props.memory_high, props.memory_max, props.memory_swap_max, props.memory_zswap_max, props.cpu_weight, props.cpu_max_usec, props.cpu_max_period_usec, props.cpuset_cpus, props.cpuset_cpus_effective, props.cpuset_mems, props.cpuset_mems_effective, cpu.usage_pct, cpu.user_pct, cpu.system_pct, cpu.nr_periods_per_sec, cpu.nr_throttled_per_sec, cpu.throttled_pct, mem.total, mem.swap, mem.anon, mem.file, mem.kernel, mem.kernel_stack, mem.slab, mem.sock, mem.shmem, mem.zswap, mem.zswapped, mem.file_mapped, mem.file_dirty, mem.file_writeback, mem.anon_thp, mem.inactive_anon, mem.active_anon, mem.inactive_file, mem.active_file, mem.unevictable, mem.slab_reclaimable, mem.slab_unreclaimable, mem.pgfault, mem.pgmajfault, mem.workingset_refault_anon, mem.workingset_refault_file, mem.workingset_activate_anon, mem.workingset_activate_file, mem.workingset_restore_anon, mem.workingset_restore_file, mem.workingset_nodereclaim, mem.pgrefill, mem.pgscan, mem.pgsteal, mem.pgactivate, mem.pgdeactivate, mem.pglazyfree, mem.pglazyfreed, mem.thp_fault_alloc, mem.thp_collapse_alloc, mem.events_low, mem.events_high, mem.events_max, mem.events_oom, mem.events_oom_kill, mem.events_local_low, mem.events_local_high, mem.events_local_max, mem.events_local_oom, mem.events_local_oom_kill, pids.tids_current, io_details.<key>.rbytes_per_sec, io_details.<key>.wbytes_per_sec, io_details.<key>.rios_per_sec, io_details.<key>.wios_per_sec, io_details.<key>.dbytes_per_sec, io_details.<key>.dios_per_sec, io_details.<key>.rwbytes_per_sec, io_details.<key>.cost_usage_pct, io_details.<key>.cost_wait_pct, io_details.<key>.cost_indebt_pct, io_details.<key>.cost_indelay_pct, io.rbytes_per_sec, io.wbytes_per_sec, io.rios_per_sec, io.wios_per_sec, io.dbytes_per_sec, io.dios_per_sec, io.rwbytes_per_sec, io.cost_usage_pct, io.cost_wait_pct, io.cost_indebt_pct, io.cost_indelay_pct, pressure.cpu_some_pct, pressure.cpu_full_pct, pressure.io_some_pct, pressure.io_full_pct, pressure.memory_some_pct, pressure.memory_full_pct, cgroup_stat.nr_descendants, cgroup_stat.nr_dying_descendants, mem_numa.<key>.total, mem_numa.<key>.anon, mem_numa.<key>.file, mem_numa.<key>.kernel_stack, mem_numa.<key>.pagetables, mem_numa.<key>.shmem, mem_numa.<key>.file_mapped, mem_numa.<key>.file_dirty, mem_numa.<key>.file_writeback, mem_numa.<key>.swapcached, mem_numa.<key>.anon_thp, mem_numa.<key>.file_thp, mem_numa.<key>.shmem_thp, mem_numa.<key>.inactive_anon, mem_numa.<key>.active_anon, mem_numa.<key>.inactive_file, mem_numa.<key>.active_file, mem_numa.<key>.unevictable, mem_numa.<key>.slab_reclaimable, mem_numa.<key>.slab_unreclaimable, mem_numa.<key>.workingset_refault_anon, mem_numa.<key>.workingset_refault_file, mem_numa.<key>.workingset_activate_anon, mem_numa.<key>.workingset_activate_file, mem_numa.<key>.workingset_restore_anon, mem_numa.<key>.workingset_restore_file, mem_numa.<key>.workingset_nodereclaim

Aggregated fields

cpu: includes [cpu.usage_pct].

mem: includes [mem.total].

io: includes [io.rbytes_per_sec, io.wbytes_per_sec].

pressure: includes [pressure.cpu_some_pct, pressure.memory_full_pct, pressure.io_full_pct].

--detail: includes [<agg_field>.*] for each given aggregated field.

--default: includes [name, inode_number, datetime, cpu, mem, io, pressure, timestamp].

--everything: includes everything (equivalent to --default --detail).

OPTIONS

-f, --fields <FIELDS>...

Select which fields to display and in what order.

--default

Show all top-layer fields. Overrides any fields specified with --fields.

--everything

Display all available fields. Overrides --fields and --default.

-d, --detail

Include additional details beyond the default fields.

-b, --begin <BEGIN>

Specify the starting time for data collection. Accepts the same format as the replay command.

-e, --end <END>

Specify the ending time for data collection. Accepts the same format as the replay command.

--duration <DURATION>

Define the duration of data collection using a time string (e.g., "10 min"). Keywords: days, min, h, sec. Relative formats (e.g., "2 days 3 hr 15m 10sec") are supported.

-F, --filter <FILTER>

Apply a regular expression filter to the field selected by --select.

--sort

Sort results in ascending order based on the field selected by --select.

--rsort

Sort results in descending order based on the field selected by --select.

--top <TOP>

Display the top TOP entries based on the sorted field. Defaults to 0.

--repeat-title <REPEAT_TITLE>

Repeat the title line every N lines. Applies only to raw output formats.

-O, --output-format <OUTPUT_FORMAT>

Specify the output format. Supported formats: raw, csv, tsv, kv, json, openmetrics. Defaults to raw.

-o, --output <OUTPUT>

Set the output destination. Defaults to standard output.

--disable-title

Disable the title in raw, csv, or tsv format outputs.

-r <YESTERDAYS>

Adjust the start date relative to the current date. Functions like the -r option in the replay command.

--br <BR>

Set a custom line break symbol between samples.

--raw

Output raw data without units or conversion.

-s, --select <SELECT>

Select a field for operations like --sort, --rsort, --filter, or --top.

-p, --pattern <PATTERN>

Use a saved pattern from the dumprc file under the [cgroup] section.

Example Commands

below dump cgroup -b 08:30:00 -e 08:30:30 -f name cpu -O csv

Outputs statistics for all cgroups, displaying the name and cpu fields in CSV format, from 08:30:00 to 08:30:30.

below dump cgroup -b 08:30:00 -e 08:30:30 -s name -F below* -O json

Outputs statistics for all cgroups matching the pattern below* in JSON format for the specified time range.

below dump cgroup -b 08:30:00 -e 08:30:30 -s cpu.usage_pct --rsort --top 5

Outputs statistics for the top 5 CPU-intensive cgroups, sorted in descending order, for the specified time range.

dump iface

Dump the link layer iface stats

Available fields

timestamp, datetime, interface, rx_bytes_per_sec, tx_bytes_per_sec, throughput_per_sec, rx_packets_per_sec, tx_packets_per_sec, collisions, multicast, rx_bytes, rx_compressed, rx_crc_errors, rx_dropped, rx_errors, rx_fifo_errors, rx_frame_errors, rx_length_errors, rx_missed_errors, rx_nohandler, rx_over_errors, rx_packets, tx_aborted_errors, tx_bytes, tx_carrier_errors, tx_compressed, tx_dropped, tx_errors, tx_fifo_errors, tx_heartbeat_errors, tx_packets, tx_window_errors, tx_timeout_per_sec, raw_stats, queues.<idx>.interface, queues.<idx>.queue_id, queues.<idx>.rx_bytes_per_sec, queues.<idx>.tx_bytes_per_sec, queues.<idx>.rx_count_per_sec, queues.<idx>.tx_count_per_sec, queues.<idx>.tx_missed_tx, queues.<idx>.tx_unmask_interrupt, queues.<idx>.raw_stats

Aggregated fields

rate: includes [rx_bytes_per_sec, tx_bytes_per_sec, throughput_per_sec, rx_packets_per_sec, tx_packets_per_sec].

rx: includes [rx_bytes, rx_compressed, rx_crc_errors, rx_dropped, rx_errors, rx_fifo_errors, rx_frame_errors, rx_length_errors, rx_missed_errors, rx_nohandler, rx_over_errors, rx_packets].

tx: includes [tx_aborted_errors, tx_bytes, tx_carrier_errors, tx_compressed, tx_dropped, tx_errors, tx_fifo_errors, tx_heartbeat_errors, tx_packets, tx_window_errors].

ethtool: includes [tx_timeout_per_sec].

--detail: includes `raw_stats` field.

--default: includes [datetime, collisions, multicast, interface, rate, rx, tx, ethtool, timestamp].

--everything: includes everything (equivalent to --default --detail).

OPTIONS

-f, --fields <FIELDS>...

Select which fields to display and in what order.

--default

Show all top-layer fields. Overrides any fields specified with --fields.

--everything

Display all available fields. Overrides --fields and --default.

-d, --detail

Include additional details beyond the default fields.

-b, --begin <BEGIN>

Specify the starting time for data collection. Accepts the same format as the replay command.

-e, --end <END>

Specify the ending time for data collection. Accepts the same format as the replay command.

--duration <DURATION>

Define the duration of data collection using a time string (e.g., "10 min"). Keywords: days, min, h, sec. Relative formats (e.g., "2 days 3 hr 15m 10sec") are supported.

-F, --filter <FILTER>

Apply a regular expression filter to the field selected by --select.

--sort

Sort results in ascending order based on the field selected by --select.

--rsort

Sort results in descending order based on the field selected by --select.

--top <TOP>

Display the top TOP entries based on the sorted field. Defaults to 0.

--repeat-title <REPEAT_TITLE>

Repeat the title line every N lines. Applies only to raw output formats.

-O, --output-format <OUTPUT_FORMAT>

Specify the output format. Supported formats: raw, csv, tsv, kv, json, openmetrics. Defaults to raw.

-o, --output <OUTPUT>

Set the output destination. Defaults to standard output.

--disable-title

Disable the title in raw, csv, or tsv format outputs.

-r <YESTERDAYS>

Adjust the start date relative to the current date. Functions like the -r option in the replay command.

--br <BR>

Set a custom line break symbol between samples.

--raw

Output raw data without units or conversion.

-s, --select <SELECT>

Select a field for operations like --filter.

-p, --pattern <PATTERN>

Use a saved pattern from the dumprc file under the [iface] section.

Example Commands

below dump iface -b 08:30:00 -e 08:30:30 -f interface rate -O csv

Outputs statistics for all interfaces, displaying the interface and rate fields in CSV format, from 08:30:00 to 08:30:30.

below dump iface -b 08:30:00 -e 08:30:30 -s interface -F eth* -O json

Outputs statistics for all interfaces matching the pattern eth* in JSON format for the specified time range.

dump network

Dump the network layer stats including ip and icmp

Available fields

timestamp, datetime, interfaces.<key>.interface, interfaces.<key>.rx_bytes_per_sec, interfaces.<key>.tx_bytes_per_sec, interfaces.<key>.throughput_per_sec, interfaces.<key>.rx_packets_per_sec, interfaces.<key>.tx_packets_per_sec, interfaces.<key>.collisions, interfaces.<key>.multicast, interfaces.<key>.rx_bytes, interfaces.<key>.rx_compressed, interfaces.<key>.rx_crc_errors, interfaces.<key>.rx_dropped, interfaces.<key>.rx_errors, interfaces.<key>.rx_fifo_errors, interfaces.<key>.rx_frame_errors, interfaces.<key>.rx_length_errors, interfaces.<key>.rx_missed_errors, interfaces.<key>.rx_nohandler, interfaces.<key>.rx_over_errors, interfaces.<key>.rx_packets, interfaces.<key>.tx_aborted_errors, interfaces.<key>.tx_bytes, interfaces.<key>.tx_carrier_errors, interfaces.<key>.tx_compressed, interfaces.<key>.tx_dropped, interfaces.<key>.tx_errors, interfaces.<key>.tx_fifo_errors, interfaces.<key>.tx_heartbeat_errors, interfaces.<key>.tx_packets, interfaces.<key>.tx_window_errors, interfaces.<key>.tx_timeout_per_sec, interfaces.<key>.raw_stats, interfaces.<key>.queues.<idx>.interface, interfaces.<key>.queues.<idx>.queue_id, interfaces.<key>.queues.<idx>.rx_bytes_per_sec, interfaces.<key>.queues.<idx>.tx_bytes_per_sec, interfaces.<key>.queues.<idx>.rx_count_per_sec, interfaces.<key>.queues.<idx>.tx_count_per_sec, interfaces.<key>.queues.<idx>.tx_missed_tx, interfaces.<key>.queues.<idx>.tx_unmask_interrupt, interfaces.<key>.queues.<idx>.raw_stats, tcp.active_opens_per_sec, tcp.passive_opens_per_sec, tcp.attempt_fails_per_sec, tcp.estab_resets_per_sec, tcp.curr_estab_conn, tcp.in_segs_per_sec, tcp.out_segs_per_sec, tcp.retrans_segs_per_sec, tcp.retrans_segs, tcp.in_errs, tcp.out_rsts_per_sec, tcp.in_csum_errors, ip.forwarding_pkts_per_sec, ip.in_receives_pkts_per_sec, ip.forw_datagrams_per_sec, ip.in_discards_pkts_per_sec, ip.in_delivers_pkts_per_sec, ip.out_requests_per_sec, ip.out_discards_pkts_per_sec, ip.out_no_routes_pkts_per_sec, ip.in_mcast_pkts_per_sec, ip.out_mcast_pkts_per_sec, ip.in_bcast_pkts_per_sec, ip.out_bcast_pkts_per_sec, ip.in_octets_per_sec, ip.out_octets_per_sec, ip.in_mcast_octets_per_sec, ip.out_mcast_octets_per_sec, ip.in_bcast_octets_per_sec, ip.out_bcast_octets_per_sec, ip.in_no_ect_pkts_per_sec, ip6.in_receives_pkts_per_sec, ip6.in_hdr_errors, ip6.in_no_routes_pkts_per_sec, ip6.in_addr_errors, ip6.in_discards_pkts_per_sec, ip6.in_delivers_pkts_per_sec, ip6.out_forw_datagrams_per_sec, ip6.out_requests_per_sec, ip6.out_no_routes_pkts_per_sec, ip6.in_mcast_pkts_per_sec, ip6.out_mcast_pkts_per_sec, ip6.in_octets_per_sec, ip6.out_octets_per_sec, ip6.in_mcast_octets_per_sec, ip6.out_mcast_octets_per_sec, ip6.in_bcast_octets_per_sec, ip6.out_bcast_octets_per_sec, icmp.in_msgs_per_sec, icmp.in_errors, icmp.in_dest_unreachs, icmp.out_msgs_per_sec, icmp.out_errors, icmp.out_dest_unreachs, icmp6.in_msgs_per_sec, icmp6.in_errors, icmp6.in_dest_unreachs, icmp6.out_msgs_per_sec, icmp6.out_errors, icmp6.out_dest_unreachs, udp.in_datagrams_pkts_per_sec, udp.no_ports, udp.in_errors, udp.out_datagrams_pkts_per_sec, udp.rcvbuf_errors, udp.sndbuf_errors, udp.ignored_multi, udp6.in_datagrams_pkts_per_sec, udp6.no_ports, udp6.in_errors, udp6.out_datagrams_pkts_per_sec, udp6.rcvbuf_errors, udp6.sndbuf_errors, udp6.in_csum_errors, udp6.ignored_multi

Aggregated fields

ip: includes [ip.forwarding_pkts_per_sec, ip.in_receives_pkts_per_sec, ip.forw_datagrams_per_sec, ip.in_discards_pkts_per_sec, ip.in_delivers_pkts_per_sec, ip.out_requests_per_sec, ip.out_discards_pkts_per_sec, ip.out_no_routes_pkts_per_sec, ip.in_mcast_pkts_per_sec, ip.out_mcast_pkts_per_sec, ip.in_bcast_pkts_per_sec, ip.out_bcast_pkts_per_sec, ip.in_octets_per_sec, ip.out_octets_per_sec, ip.in_mcast_octets_per_sec, ip.out_mcast_octets_per_sec, ip.in_bcast_octets_per_sec, ip.out_bcast_octets_per_sec, ip.in_no_ect_pkts_per_sec].

ip6: includes [ip6.in_receives_pkts_per_sec, ip6.in_hdr_errors, ip6.in_no_routes_pkts_per_sec, ip6.in_addr_errors, ip6.in_discards_pkts_per_sec, ip6.in_delivers_pkts_per_sec, ip6.out_forw_datagrams_per_sec, ip6.out_requests_per_sec, ip6.out_no_routes_pkts_per_sec, ip6.in_mcast_pkts_per_sec, ip6.out_mcast_pkts_per_sec, ip6.in_octets_per_sec, ip6.out_octets_per_sec, ip6.in_mcast_octets_per_sec, ip6.out_mcast_octets_per_sec, ip6.in_bcast_octets_per_sec, ip6.out_bcast_octets_per_sec].

icmp: includes [icmp.in_msgs_per_sec, icmp.in_errors, icmp.in_dest_unreachs, icmp.out_msgs_per_sec, icmp.out_errors, icmp.out_dest_unreachs].

icmp6: includes [icmp6.in_msgs_per_sec, icmp6.in_errors, icmp6.in_dest_unreachs, icmp6.out_msgs_per_sec, icmp6.out_errors, icmp6.out_dest_unreachs].

--detail: no effect.

--default: includes [datetime, ip, ip6, icmp, icmp6, timestamp].

--everything: includes everything (equivalent to --default --detail).

dump transport

Dump the transport layer stats including tcp and udp

Available fields

timestamp, datetime, interfaces.<key>.interface, interfaces.<key>.rx_bytes_per_sec, interfaces.<key>.tx_bytes_per_sec, interfaces.<key>.throughput_per_sec, interfaces.<key>.rx_packets_per_sec, interfaces.<key>.tx_packets_per_sec, interfaces.<key>.collisions, interfaces.<key>.multicast, interfaces.<key>.rx_bytes, interfaces.<key>.rx_compressed, interfaces.<key>.rx_crc_errors, interfaces.<key>.rx_dropped, interfaces.<key>.rx_errors, interfaces.<key>.rx_fifo_errors, interfaces.<key>.rx_frame_errors, interfaces.<key>.rx_length_errors, interfaces.<key>.rx_missed_errors, interfaces.<key>.rx_nohandler, interfaces.<key>.rx_over_errors, interfaces.<key>.rx_packets, interfaces.<key>.tx_aborted_errors, interfaces.<key>.tx_bytes, interfaces.<key>.tx_carrier_errors, interfaces.<key>.tx_compressed, interfaces.<key>.tx_dropped, interfaces.<key>.tx_errors, interfaces.<key>.tx_fifo_errors, interfaces.<key>.tx_heartbeat_errors, interfaces.<key>.tx_packets, interfaces.<key>.tx_window_errors, interfaces.<key>.tx_timeout_per_sec, interfaces.<key>.raw_stats, interfaces.<key>.queues.<idx>.interface, interfaces.<key>.queues.<idx>.queue_id, interfaces.<key>.queues.<idx>.rx_bytes_per_sec, interfaces.<key>.queues.<idx>.tx_bytes_per_sec, interfaces.<key>.queues.<idx>.rx_count_per_sec, interfaces.<key>.queues.<idx>.tx_count_per_sec, interfaces.<key>.queues.<idx>.tx_missed_tx, interfaces.<key>.queues.<idx>.tx_unmask_interrupt, interfaces.<key>.queues.<idx>.raw_stats, tcp.active_opens_per_sec, tcp.passive_opens_per_sec, tcp.attempt_fails_per_sec, tcp.estab_resets_per_sec, tcp.curr_estab_conn, tcp.in_segs_per_sec, tcp.out_segs_per_sec, tcp.retrans_segs_per_sec, tcp.retrans_segs, tcp.in_errs, tcp.out_rsts_per_sec, tcp.in_csum_errors, ip.forwarding_pkts_per_sec, ip.in_receives_pkts_per_sec, ip.forw_datagrams_per_sec, ip.in_discards_pkts_per_sec, ip.in_delivers_pkts_per_sec, ip.out_requests_per_sec, ip.out_discards_pkts_per_sec, ip.out_no_routes_pkts_per_sec, ip.in_mcast_pkts_per_sec, ip.out_mcast_pkts_per_sec, ip.in_bcast_pkts_per_sec, ip.out_bcast_pkts_per_sec, ip.in_octets_per_sec, ip.out_octets_per_sec, ip.in_mcast_octets_per_sec, ip.out_mcast_octets_per_sec, ip.in_bcast_octets_per_sec, ip.out_bcast_octets_per_sec, ip.in_no_ect_pkts_per_sec, ip6.in_receives_pkts_per_sec, ip6.in_hdr_errors, ip6.in_no_routes_pkts_per_sec, ip6.in_addr_errors, ip6.in_discards_pkts_per_sec, ip6.in_delivers_pkts_per_sec, ip6.out_forw_datagrams_per_sec, ip6.out_requests_per_sec, ip6.out_no_routes_pkts_per_sec, ip6.in_mcast_pkts_per_sec, ip6.out_mcast_pkts_per_sec, ip6.in_octets_per_sec, ip6.out_octets_per_sec, ip6.in_mcast_octets_per_sec, ip6.out_mcast_octets_per_sec, ip6.in_bcast_octets_per_sec, ip6.out_bcast_octets_per_sec, icmp.in_msgs_per_sec, icmp.in_errors, icmp.in_dest_unreachs, icmp.out_msgs_per_sec, icmp.out_errors, icmp.out_dest_unreachs, icmp6.in_msgs_per_sec, icmp6.in_errors, icmp6.in_dest_unreachs, icmp6.out_msgs_per_sec, icmp6.out_errors, icmp6.out_dest_unreachs, udp.in_datagrams_pkts_per_sec, udp.no_ports, udp.in_errors, udp.out_datagrams_pkts_per_sec, udp.rcvbuf_errors, udp.sndbuf_errors, udp.ignored_multi, udp6.in_datagrams_pkts_per_sec, udp6.no_ports, udp6.in_errors, udp6.out_datagrams_pkts_per_sec, udp6.rcvbuf_errors, udp6.sndbuf_errors, udp6.in_csum_errors, udp6.ignored_multi.

Aggregated fields

tcp: includes [tcp.active_opens_per_sec, tcp.passive_opens_per_sec, tcp.attempt_fails_per_sec, tcp.estab_resets_per_sec, tcp.curr_estab_conn, tcp.in_segs_per_sec, tcp.out_segs_per_sec, tcp.retrans_segs_per_sec, tcp.retrans_segs, tcp.in_errs, tcp.out_rsts_per_sec, tcp.in_csum_errors].

udp: includes [udp.in_datagrams_pkts_per_sec, udp.no_ports, udp.in_errors, udp.out_datagrams_pkts_per_sec, udp.rcvbuf_errors, udp.sndbuf_errors, udp.ignored_multi].

udp6: includes [udp6.in_datagrams_pkts_per_sec, udp6.no_ports, udp6.in_errors, udp6.out_datagrams_pkts_per_sec, udp6.rcvbuf_errors, udp6.sndbuf_errors, udp6.in_csum_errors, udp6.ignored_multi].

--detail: no effect.

--default: includes [datetime, tcp, udp, udp6, timestamp].

--everything: includes everything (equivalent to --default --detail).

dump ethtool-queue

Dump network interface queue stats

Available fields

timestamp, datetime, and expanded fields below.

Aggregated fields

queue: includes [interface, queue_id, rx_bytes_per_sec, tx_bytes_per_sec, rx_count_per_sec, tx_count_per_sec, tx_missed_tx, tx_unmask_interrupt].

--detail: includes `raw_stats` field.

--default: includes [datetime, queue, timestamp].

--everything: includes everything (equivalent to --default --detail).

below dump tc

Dump the tc related stats with qdiscs

Available fields

timestamp, datetime, interface, kind, qlen, bps, pps, bytes_per_sec, packets_per_sec, backlog_per_sec, drops_per_sec, requeues_per_sec, overlimits_per_sec, qdisc.fq_codel.target, qdisc.fq_codel.limit, qdisc.fq_codel.interval, qdisc.fq_codel.ecn, qdisc.fq_codel.quantum, qdisc.fq_codel.ce_threshold, qdisc.fq_codel.drop_batch_size, qdisc.fq_codel.memory_limit, qdisc.fq_codel.flows, xstats.fq_codel.maxpacket, xstats.fq_codel.ecn_mark, xstats.fq_codel.new_flows_len, xstats.fq_codel.old_flows_len, xstats.fq_codel.ce_mark, xstats.fq_codel.drop_overlimit_per_sec, xstats.fq_codel.new_flow_count_per_sec, xstats.fq_codel.memory_usage_per_sec, xstats.fq_codel.drop_overmemory_per_sec.

Aggregated fields

--detail: no effect.

--default: includes [datetime, stats, xstats, qdisc, timestamp].

--everything: includes everything (equivalent to --default --detail).

snapshot

Create a historical snapshot file for a given time range. This subcommand supports the following options:

-b, --begin <BEGIN>

Specify the beginning time. Accepts the same formats as replay.

-e, --end <END>

Specify the ending time. Accepts the same formats as replay.

--duration <DURATION>

Specify the snapshot duration. Accepts relative time strings like "10m", "2h", etc.

-o, --output <OUTPUT>

Specify the output file path. If unspecified, a randomized name is generated in the current directory.

-s, --host <HOST>

Supply hostname to take snapshot from remote.

--port <PORT>

Override the default port for remote snapshot creation.