This article explains how to configure processor & memory usage, disk utilization, and other resource usage history via atop output logging.
Applies to the following Sophos product(s) and version(s)
Sophos UTM 100/110/120 v9.204
Sophos UTM, version 7, 8, 9
What To Do
atop is a Linux process monitor tool which is similar to top, but provides more detailed information about the system state, as well as the ability to save its output to a file periodically so that the resource utilization of the system can be recorded and retrieved at a later time (for example, so that you can monitor utilization during rare or intermittent events without having to actively wait for them to occur).
To enable atop logging:
1. Open cron
# crontab -e
2. Add the following lines
58 23 * * * killall atop
05 0 * * * rm -f /var/log/atop.log
07 0 * * * atop -w /var/log/atop.log 5
3. Save the file
The above erases the existing log & creates a new one just after midnight daily (only one day of output is stored, due to the rate at which the logfile increases - about 200mb/day). The 5 on the third line means that the output of atop is written to the log every 5 seconds. You can increase or decrease the value if necessary.
To disable logging, type crontab -e, remove all lines, and save again.
To read the log:
# atop -r /var/log/atop.log
Press t to move forward to the next 5 seconds, and press shift+t to move backwards.
To read only a certain time range from the log (b for beginning, e for end):
# atop -r atop.log -b 10:00 -e 11:00
To change the view:
g - Show generic output (default)
m - Show memory related output
s - Show scheduling characteristics
c - Show the command line of the process
For more information: