filemon Command

Purpose

Monitors the performance of the file system, and reports the I/O activity on behalf of logical files, virtual memory segments, logical volumes, and physical volumes.

Syntax

filemon [ -d ] [ -i Trace_File -n Gensyms_File] [ -o File] [-O Levels ] [ -w ] [-I count:interval] [-P ] [ -T n] [-u ] [-v ] [-@ [WparList | ALL ] [ -r RootString ] [ -A -x User_Command ]

Description

The filemon command monitors a trace of file system and I/O system events, and reports on the file and I/O access performance during that period.

In its normal mode, the filemon command runs in the background while one or more application programs or system commands are being run and monitored. The filemon command automatically starts and monitors a trace of the program file system and I/O events in real time. By default, the trace is started immediately; optionally, tracing might be deferred until you issue a trcon command. You can issue the trcoff and trcon commands while the filemon command is running to turn the monitoring off and on, as required. When tracing is stopped by a trcstop command, the filemon command generates an I/O activity report and exits.

The filemon command can also process a trace file that is previously recorded by the trace facility. The file and I/O activity report are based on the events recorded in that file.

To provide a complete understanding of file system performance for an application, the filemon command monitors file and I/O activity at four levels:

Item Description
Logical file system The filemon command monitors logical I/O operations on logical files. The monitored operations include all read, write, open, and lseek system calls, which might or might not result in actual physical I/O, depending on whether the files are already buffered in memory. I/O statistics are kept on a per-file basis. Calls to Asynchronous I/O system calls are not monitored by the filemon command, so the filemon logical file report does not include asynchronous I/O (AIO) requests.
Virtual memory system The filemon command monitors physical I/O operations (that is, paging) between segments and their images on disk. I/O statistics are kept on a per-segment basis.
Logical volumes The filemon command monitors I/O operations on logical volumes. I/O statistics are kept on a per-logical-volume basis.
Physical volumes The filemon command monitors I/O operations on physical volumes. At this level, physical resource utilizations are obtained. I/O statistics are kept on a per-physical-volume basis.

Any combination of the four levels can be monitored, as specified by the command-line flags. By default, the filemon command only monitors I/O operations at the virtual memory, logical volume, and physical volume levels. These levels are all concerned with requests for real disk I/O.

The filemon command also generates a hotness report on the files, logical volumes, and physical volumes. The hotness report can be generated by using –O hot option. This report is supported only in automated offline and manual offline modes. Hotness report contains statistics of I/O operations of files, logical volumes, and physical volumes. This report helps you decide which files or logical volumes to move to any drive, with a different I/O characteristic based on the hotness of the file/logical volume. The hotness is determined based on number of read operations, average number of bytes read per read operation, number of read sequences and the average sequence length.

The filemon command writes its report to standard output or to a specified file. By default the report contains a summary of the I/O activity for each of the levels being monitored. Detailed report is printed only if the -O detailed flag is enabled. The summary and detailed report contents are described in the Reports section.

Notes:
  1. The reports produced by the filemon command can be long. Consequently, the -o option is to be used to write the report to an output file. When a physical device is opened and accessed directly by an application, only reads and writes of complete 512-byte blocks are reflected in the report. “Short” reads and writes, used by the device driver to issue device commands and read device status, are ignored. CD-ROMs do not have concentric “tracks” or “cylinders,” as in hard files. (There is one spiral track.) Consequently, it is not possible to report distance statistics for CD-ROMs in terms of cylinders.
  2. The -u flag is used to generate reports on files opened before the start of the trace daemon. Some of this data can be useful, but much of it applies to daemons and other unrelated activity. This background information can be overwhelming, especially on large systems. If the /unix file and the running kernel are not the same, then the kernel addresses are incorrect, causing the filemon command to exit. When using the filemon command from within a shell script, view the contents of the filemon output file after a slight delay. The filemon command might take a few seconds to produce this report.
  3. When you specify relative paths in an I/O process program to read or write a file, the filemon command interprets this relative path as the directory from where the filemon command was run. In such cases, the I/O activity report might not display the correct volume information (i-node) for that file. To avoid this problem, use the complete path in all the I/O process programs.
  4. The filemon command does not support the solid state drive (SSD) disks. Hence, the filemon command does not report statistics of the SSD disks.

System Trace Facility

The filemon command obtains raw I/O performance data using the system trace facility. Currently, the trace facility only supports one output stream. Consequently, only one filemon or trace process can be active at a time. If another filemon or trace process is already running, the filemon command responds with the message:

/dev/systrace: Device busy

While monitoring the I/O-intensive applications, the filemon command might not be able to consume trace events as fast as they are produced in real time. When that happens, the error message:

Trace kernel buffers overflowed, N missed entries

is displayed on stderr, indicating how many trace events were lost while the trace buffers were full. The filemon command continues monitoring the I/O activity, but the accuracy of the report is diminished to some unknown degree. One way to prevent overflow is to monitor fewer levels of the file and I/O subsystems: the number of trace events generated is proportional to the number of levels monitored. Additionally, the trace buffer size can be increased using the -T option, to accommodate larger bursts of trace events before overflow. Remember that increasing the trace buffer size results in more pinned memory, and therefore might affect I/O and paging behavior.

In memory-constrained environments (where demand for memory exceeds supply), the -P option can be used to pin the text and data pages of the real-time filemon process in memory so the pages cannot be swapped out. If the -P option is not used, letting the filemon process to be swapped out, the progress of the filemon command might be delayed to the point where it cannot process trace events fast enough. This situation leads to trace buffer overflow as described previously. Consequently, pinning this process takes memory away from the application (although the filemon command is not a large program, its process image can consume up to 500KB).

The -i Trace_File and -n Gensyms_File flags let offline processing by filemon of trace data files created by the trace command. Both flags must be supplied if either is present. These flags are useful when it is necessary to postprocess a trace file from a remote machine or perform the trace data collection at one time and postprocess it at another time. The flags are also useful when system load is high and trace hooks are being missed by filemon. You can use these flags for automated offline mode.

The -r RootString flag deprecates the -i Trace_File flag and the -n Gensyms_File flag. Apart from using the -r RootString flag for offline processing, the same can be used along with the -A flag which enables automated offline mode.

The gensyms file (containing file system information) must be used from the machine that the trace came from. Also, it is wise to run gensyms at close to the same time that the system trace file is created, so that the system configuration is the same for both.

Trace hooks relevant to filemon must be collected by the trace command and are specified by the trace -j flag. The relevant trace hooks are listed when filemon is started with the -v flag. The gensyms command with -F option is then run, with its output saved in Gensyms_File to collect additional information for filemon. The -F option is used with the gensyms command to collect the device information for physical and logical volumes. It is also used to get the virtual file system information used by offline filemon. Then this file and the Gensyms_File might be provided to filemon.

Reports

Each report generated by the filemon command has a header that identifies the date, the machine ID, and the length of the monitoring period, in seconds. The processor utilization during the monitoring period is also reported.

Next, summary reports are generated for each of the file system levels being monitored. By default, the logical file and virtual memory reports are limited to the 20 most active files and segments, as measured by the total amount of data transferred. If the -v flag is specified, activity for all files and segments is reported. There is one row for each reported file, segment, or volume. The columns in each row for the four summary reports are described in the following lists:

Most Active Files Report

Column Description
#MBS Total number of megabytes transferred to or from file. The rows are sorted by this field, in decreasing order.
#opns Number of times the file was opened during measurement period.
#rds Number of read system calls made against file.
#wrs Number of write system calls made against file.
file Name of file (full path name is in detailed report).
volume:inode Name of volume that contains the file, and the i-node number of the file. This field can be used to associate a file with its corresponding persistent segment, shown in the virtual memory I/O reports. This field might be blank; for example, for temporary files created and deleted during execution.

Most Active Segments Report

Item Description
Column Description
#MBS Total number of megabytes transferred to/from segment. The rows are sorted by this field, in decreasing order.
#rpgs Number of 4096-byte pages read into segment from disk (that is, page).
#wpgs Number of 4096-byte pages written from segment to disk (page out).
segid Internal ID of segment.
segtype Type of segment: working segment, persistent segment (local file), client segment (remote file), page table segment, system segment, or special persistent segments containing file system data (log, root directory, .inode, .inodemap, .inodex, .inodexmap, .indirect, .diskmap).
volume:inode For persistent segments, name of volume that contains the associated file, and the i-node number of the file. This field can be used to associate a persistent segment with its corresponding file, shown in the file I/O reports. This field is blank for non-persistent segments.
Note: The virtual memory analysis tool, svmon can be used to display more information about a segment, given its segment ID (segid), as follows:
svmon -S <segid>

Most Active Logical Volumes Report

Item Description
Column Description
util Utilization of the volume (fraction of time busy). The rows are sorted by this field, in decreasing order.
#rblk Number of 512-byte blocks read from the volume.
#wblk Number of 512-byte blocks written to the volume.
KB/sec Total transfer throughput, in Kilobytes per second.
volume Name of volume.
description Contents of volume: either a file system name, or logical volume type (paging, jfslog, boot, or sysdump). Also, indicates whether the file system is fragmented or compressed.

Most Active Physical Volumes Report

Item Description
Column Description
util Utilization of the volume (fraction of time busy). The rows are sorted by this field, in decreasing order.
#rblk Number of 512-byte blocks read from the volume.
#wblk Number of 512-byte blocks written to the volume.
KB/sec Total volume throughput, in Kilobytes per second.
volume Name of volume.
description Type of volume, for example, 120MB disk, 355MB SCSI, or CDROM SCSI.
Note: Logical volume I/O requests start before, and end after, physical volume I/O requests. For that reason, total logical volume utilization appears to be higher than total physical volume utilization.

Most Active Files Process-Wise Report

Item Description
Column Description
#MBS Total number of megabytes transferred to or from the file. The rows are sorted by this field, in decreasing order.
#opns Number of times the file was opened during measurement period.
#rds Number of read system calls made against file.
#wrs Number of write system calls made against file.
file Name of file (full path name is in detailed report).
PID ID of the process which opened the file.
Process Name of the process which opened the file.
TID ID of the thread which opened the file.

Most Active Files Thread-Wise Report

Item Description
Column Description
#MBS Total number of megabytes transferred to or from the file. The rows are sorted by this field, in decreasing order.
#opns Number of times the file was opened during measurement period.
#rds Number of read system calls made against file.
#wrs Number of write system calls made against file.
file Name of file (full path name is in detailed report).
TID ID of the thread which opened the file.
Process Name of the process which opened the file.
PID ID of the process which opened the file.

Finally, detailed reports are generated for each of the file system levels being monitored. By default, the logical file and virtual memory reports are limited to the 20 most active files and segments, as measured by the total amount of data transferred. If the -v flag is specified, activity for all files and segments is reported. There is one entry for each reported file, segment, or volume.

Some of the fields report a single value, others report statistics that characterize a distribution of many values. For example, response time statistics are kept for all read or write requests that were monitored. The average, minimum, and maximum response times and the standard deviation of the response times are reported. The standard deviation is used to show how much the individual response times deviated from the average. Roughly two-thirds of the sampled response times are between average - standard deviation and average + standard deviation. If the distribution of response times is scattered over a large range, the standard deviation will be large compared to the average response time. The four detailed reports are described in the following lists:

Detailed File Statistics Report

Item Description
Column Description
FILE Name of the file. The full path name is given, if possible.
volume Name of the logical volume/file system containing the file.
inode I-node number for the file within its file system.
opens Number of times the file was opened while monitored.
total bytes xfrd Total number of bytes read/written to/from the file.
reads Number of read calls against the file.
read sizes (bytes) The read transfer-size statistics (avg/min/max/sdev), in bytes.
read times (msec) The read response-time statistics (avg/min/max/sdev), in milliseconds.
writes Number of write calls against the file.
write sizes (bytes) The write transfer-size statistics.
write times (msec) The write response-time statistics.
seeks Number of lseek subroutine calls.

Detailed VM Segment Statistics Report

Item Description
Column Description
SEGMENT Internal segment ID.
segtype Type of segment contents.
segment flags Various segment attributes.
volume For persistent segments, the name of the logical volume containing the corresponding file.
inode For persistent segments, the i-node number for the corresponding file.
reads Number of 4096-byte pages read into the segment (that is, paged in).
read times (msec) The read response-time statistics (avg/min/max/sdev), in milliseconds.
read sequences Number of read sequences. A sequence is a string of pages that are read (paged in) consecutively. The number of read sequences is an indicator of the amount of sequential access.
read seq. lengths Statistics describing the lengths of the read sequences, in pages.
writes Number of pages written from the segment (that is, paged out).
write times (msec) Write response time statistics.
write sequences Number of write sequences. A sequence is a string of pages that are written (paged out) consecutively.
write seq.lengths Statistics describing the lengths of the write sequences, in pages.

Detailed Logical/Physical Volume Statistics Reports

Item Description
Column Description
VOLUME Name of the volume.
description Description of the volume. (Describes contents, if dealing with a logical volume; describes type, if dealing with a physical volume.)
reads Number of read requests made against the volume.
read sizes (blks) The read transfer-size statistics (avg/min/max/sdev), in units of 512-byte blocks.
read times (msec) The read response-time statistics (avg/min/max/sdev), in milliseconds.
read sequences Number of read sequences. A sequence is a string of 512-byte blocks that are read consecutively and indicate the amount of sequential access.
read seq. lengths Statistics describing the lengths of the read sequences, in blocks.
writes Number of write requests made against the volume.
write sizes (blks) The write transfer-size statistics.
write times (msec) The write-response time statistics.
write sequences Number of write sequences. A sequence is a string of 512-byte blocks that are written consecutively.
write seq. lengths Statistics describing the lengths of the write sequences, in blocks.
seeks Number of seeks that preceded a read or write request; also expressed as a percentage of the total reads and writes that required seeks.
seek dist (blks) Seek distance statistics, in units of 512-byte blocks. In addition to the usual statistics (avg/min/max/sdev), the distance of the initial seek operation (assuming block 0 was the starting position) is reported separately. This seek distance is sometimes large, so it is reported separately to avoid skewing the other statistics.
seek dist (cyls) (Hard files only.) Seek distance statistics, in units of disk cylinders.
time to next req Statistics (avg/min/max/sdev) describing the length of time, in milliseconds, between consecutive read or write requests to the volume. This column indicates the rate at which the volume is being accessed.
throughput Total volume throughput, in Kilobytes per second.
utilization Fraction of time the volume was busy. The entries in this report are sorted by this field, in decreasing order.

Detailed Process-wise Statistics Report

Item Description
Column Description
Process Id ID of the process which opened the file.
Name Name of the file opened including the path.
Thread Id ID of the thread which opened the file.
Total Bytes Total number of bytes read or written.
# of seeks Number of seeks.
# of reads Number of read operations.
read errors Number of read errors.
# of writes Number of write operations.
Bytes Read Number of bytes read.
min
Minimum number of bytes read at a time.
avr
Average number of bytes read at a time.
max
Maximum number of bytes read at a time.
Bytes Written Number of bytes written.
min
Minimum number of bytes written at a time.
avr
Average number of bytes written at a time.
max
Maximum number of bytes written at a time.
Read Time Time spent in read operations.
Write Time Time spent in write operations.

Detailed Thread-wise Statistics Report

Item Description
Column Description
Thread Id ID of the thread which opened the file.
Name Name of the file opened including the path.
Process Id ID of the thread which opened the file.
Total Bytes Total number of bytes read or written.
# of seeks Number of seeks.
# of reads Number of read operations.
read errors Number of read errors.
# of writes Number of write operations.
Bytes Read Number of bytes read.
min
Minimum number of bytes read at a time.
avr
Average number of bytes read at a time.
max
Maximum number of bytes read at a time.
Bytes Written Number of bytes written.
min
Minimum number of bytes written at a time.
avr
Average number of bytes written at a time.
max
Maximum number of bytes written at a time.
Read Time Time spent in read operations.
Write Time Time spent in write operations.

Collated Report Format

Item Description
ID
process
ID of the process which did read or write operation.
thread
ID of the thread which did read or write operation.
CPU
ID of the CPU in which read or write operation was performed.
transaction type Type of transaction: SCSI, SSA, and so on.
time
bstart event
Time at which the bstart event was started.
iodone event
Time at which the I/O operation was completed.
duration
Total time duration of the I/O operation.
read/write Type of operation: read or write.
physical block address Physical block address.
access pattern Type of access: pattern, sequential, or random.
physical block size Physical block size.
volume name or address
physical
Physical volume name or address.
logical
Logical volume name or address.
Transaction index Unique ID to identify the transaction.
time
event
Time at which the event started.
extend
Time at which the event extended.
ID
process
ID of the process which performed the transaction.
thread
ID of the thread which performed the transaction.
CPU
ID of the CPU in which the transaction was performed.
protocol stage Displays the breakup of the events.
name Name of device, buffer, or block; or byte count.
address/count Address or byte count of device, buffer, or block.
access pattern Type of access pattern: sequential or random.
label Volume types or transfer flags.
values Volume names or flag values.

Hotness Report

The hotness report consists of three sections: information section, summary section, and hotness reports section. The information section contains the system model, the filemon command used, and the trace command used. The summary section contains: total number of read or write operations, total time taken, total data read or written, and the CPU utilization.

Hot files report

Item Description
Column Description
Name Name of the file.
Size Size of the file. The default unit is MB. The default unit is overridden by the unit specified by –O unit option.
CAP_ACC Capacity accessed. This value is the unique data accessed in the file. The default unit is MB. The default unit is overridden by the unit specified by –O unit option.
IOP/# Number of I/O operations per unit of data accessed. The unit of data is taken from –O unit option. The default is MB. Examples of value for this column are 2560/T, 256/G, 0.256/M, 0.000/K. The letters K, M, G and T stand for KB, MB, GB, and TB.
LV Name of logical volume the file belongs to. If this information cannot be obtained, a "-" is reported.
#ROP Total number of read operations happened on the file.
#WOP Total number of write operations happened on that file.
B/ROP <minimum, average, maximum> number of bytes read per read operation.
B/WOP <minimum, average, maximum> number of bytes read per write operation.
RTIME <minimum, average, maximum> time taken per read operation in milliseconds.
WTIME <minimum, average, maximum> time taken per write operation in milliseconds.
Seqlen <minimum, average, maximum> length of read sequences.
#Seq Number of read sequences. A sequence is a string of 4K pages that are read (paged in) consecutively. The number of read sequences is an indicator of the amount of sequential access.

Hot Logical Volumes Report

Item Description
Column Description
Name Name of the logical file.
Size Size of the logical volume. The default unit is MB. The default unit is overridden by the unit specified by –O unit option. If this value cannot be obtained, a “-“ is reported.
CAP_ACC Capacity accessed. This value is the unique data accessed in the file. The default unit is MB. The default unit is overridden by the unit specified by –O unit option.
IOP/# Number of I/O operations per unit of data accessed. The unit of data is taken from –O unit option. The default is MB. Examples of value for this column are 2560/T, 256/G, 0.256/M, 0.000/K. The letters K, M, G and T stand for KB, MB, GB, and TB respectively.
#Files Number of files accessed in this logical volume.
#ROP Total number of read operations happened on the logical volume.
#WOP Total number of write operations happened on that logical volume.
B/ROP <minimum, average, maximum> number of bytes read per read operation.
B/WOP <minimum, average, maximum> number of bytes read per write operation.
RTIME <minimum, average, maximum> time taken per read operation in milliseconds.
WTIME <minimum, average, maximum> time taken per write operation in milliseconds.
Seqlen <minimum, average, maximum> length of read sequences.
#Seq Number of read sequences. A sequence is a string of 4K pages that are read (paged in) consecutively. The number of read sequences is an indicator of the amount of sequential access.

Hot Physical Volumes Report

Item Description
Column Description
Name Name of the physical volume.
Size Size of the physical volume. The default unit is MB. The default unit is overridden by the unit specified by –O unit option.
CAP_ACC Capacity accessed. This value is the unique data accessed in the file. The default unit is MB. The default unit is overridden by the unit specified by –O unit option.
IOP/# Number of I/O operations per unit of data accessed. The unit of data is taken from –O unit option. The default is MB. Examples of value for this column are 2560/T, 256/G, 0.256/M, 0.000/K. The letters K, M, G and T stand for KB, MB, GB, and TB respectively.
#ROP Total number of read operations happened on the physical volume.
#WOP Total number of write operations happened on that physical volume.
B/ROP <minimum, average, maximum> number of bytes read per read operation.
B/WOP <minimum, average, maximum> number of bytes read per write operation.
RTIME <minimum, average, maximum> time taken per read operation in milliseconds.
WTIME <minimum, average, maximum> time taken per write operation in milliseconds.
Seqlen <minimum, average, maximum> length of read sequences.
#Seq Number of read sequences. A sequence is a string of 512-byte blocks that are read consecutively. The number of read sequences is an indicator of the amount of sequential access.

Each of the described hotness reports is repeated multiple times based on the sort field.

The different hotness reports based on different sort fields are:

  1. hotness report sorted on key factor
  2. hotness report sorted on CAP_ACC
  3. hotness report sorted on IOP/#
  4. hotness report sorted on #ROP
  5. hotness report sorted on #WOP
  6. hotness report sorted on RTIME
  7. hotness report sorted on WTIME

Each of the reports is sorted in descending order of the corresponding sort field.

If you specify the –O hot=r option then only read operations-based reports and report based on key factor are generated, that is, report number 1, 4, and 6 are generated.

If the user specifies –O hot=w option then only write operations-based reports and report based on key factor are generated, that is, report number 1, 5, and 7 are generated.

The key factor is determined by the values of following columns: #ROP, B/ROP, Seqlen and #Seq.

Flags

Item Description
-i Trace_File Reads the I/O trace data from the specified Trace_File, instead of from the real-time trace process. The filemon report summarizes the I/O activity for the system and period represented by the trace file. This option is deprecated. Use the -r RootString flag instead.

For the report to be accurate, the trace file must contain all the hooks required by the filemon command.

The -n option must also be specified.

-n Gensyms_File Specifies a Gensyms_File for offline trace processing. This file is created by running the gensyms command with -f option and redirecting the output to a file, as follows:
gensyms -F > file
The -i option must also be specified.

The -n flag is depredated. Use the -r RootString flag instead.

-o File Writes the I/O activity report to the specified File, instead of to the stdout file.
-d Starts the filemon command, but defers tracing until the trcon command is run by the user. By default, tracing is started immediately.
-T n Sets the trace buffer size of the kernel to n bytes. The default size is 64 000 bytes per CPU. The buffer size can be increased to accommodate larger bursts of events, if any. (A typical event record size is 30 bytes.)
Note: The trace driver in the kernel uses double buffering, so in fact there are two buffers allocated of size n bytes. Also, note that these buffers are pinned in memory, so they are not subject to paging. Large buffers might affect the performance of paging and other I/O.
-P Pins monitor process in memory. The -P flag causes the filemon command text and data pages to be pinned in memory for the duration of the monitoring period. This flag can be used to ensure that the real-time filemon process is not paged out when running in a memory-constrained environment.
-v Prints extra information in the report. The most significant effect of the -v flag is that all logical files and all segments that were accessed are included in the I/O activity report, instead of only the 20 most active files and segments.
-A -x User_Command Turns on automated offline mode. You must use the -x flag along with the -A flag where the trace is collected until the specified user command finishes its execution. The typical example of user command is sleep 10.
-r RootString If you combine this flag with the -A flag, the filemon command stores the trace data in the RootString.trc file and generates a gensyms file and stores it in the RootString.syms file. When this option is enabled in the absence of the -A flag, the filemon command posts processing the RootString.trc file and the RootString.syms file to generate offline report. This option deprecates the existing -n and -i flags. The filemon command continues to support the -i flag and the -n flag for binary compatibility.
-O Levels Monitors only the specified file system levels. Valid comma-separated options are:
abbreviated
Produces a list of transactions in abbreviated format, one line per transaction (replaces old "subpar" tool). This option is supported only in offline mode and cannot be combined with any other -O options.
collated
Produces a list of transactions in collated format: events are collected together per transaction. This option is supported only in offline mode and cannot be combined with any other -O options.
detailed
Detailed report is generated along with statistical summary mode and cannot be combined with the abbreviated option or the collated option.
lf=num
Displays only the specified number of logical file entries and cannot be combined with -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries.
vm=num
Displays only the specified number of virtual memory entries and cannot be combined with the -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries.
lv=num
Displays only the specified number of logical volume entries and cannot be combined with the -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries.
pv=num
Displays only the specified number of physical volume entries and cannot be combined with the -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries.
 
hot=r|w
Generates the hotness report. If hot=r specified then hotness reports based on read operations only are generated. If hot=w specified the hotness reports based on write operations only are generated.
sz=num
Specifies the maximum size of the files accessed to be reported in the hotness report. Unit for this value is specified by –O unit option. The default unit is MB. unit={KB|MB|GB|TB} Specifies the unit to be used with sz option and the unit to be used with CAP_ACC and Size fields in hotness report.
th=num
Displays only the specified number of thread statistics entries and cannot be combined with the -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries.
pr=num
Displays only the specified number of process statistics entries and cannot be combined with the -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries.
all=num
Sets lf=num, vm=num, lv=num, pv=num, ts=num and overwrites the old values for the options of lf, vm, lv, pv, th, and pr. This option cannot be combined with the -O abbreviated flag or the -O collated flag. If the num argument is not specified, it displays all the entries and this is the default option.
Item Description
  The vm, lv, and pv levels are implied by default when you run the filemon -O command in the global WPAR without the -@ flag. The lf level is implied by default when you run the filemon -O command in a WPAR or when you use the -@ flag.

If the num argument is not specified, the default is to display all the entries of that section. The num argument is not supported in abbreviated and collated formats and it is supported only in statistical summary. If the -O detailed flag is specified, the report is in statistical summary format along with detailed report in both online and offline mode. The default mode of operation for the filemon command is changed from Summary and Detailed Statistical report to Summary only Statistical Report. If the filemon command is called without any option or just with the -O flag with any combination of the lf, vm, lv, pv, pr, th, or all option, only summary report is displayed unless otherwise the -O detailed flag is specified.

-u Reports on files that were opened before the start of the trace daemon. The process ID (PID) and the file descriptor (FD) are substituted for the file name.
Note: Since PIDs and FDs are reusable, it is possible to see different files reported with the same name field.
-w Prints the hotness report in wide format. This option is valid only if the –O hot option is specified.
-I count:interval Specifies the count and interval to be used for multi-snapshot tracing. If this option is specified, count number of snapshots of trace is collected with a gap of interval seconds between two snapshots. This option is valid only in automated offline mode with –O hot option specified.
-@ [WparList | ALL] Reports are limited to the list of WPARs passed by the argument.

Examples

  1. To monitor the physical I/O activity of the virtual memory, logical volume, and physical volume levels of the file system, enter:
    filemon
    The filemon command automatically starts the system trace and puts itself in the background. After this command, enter the application programs and system commands to be run at this time, then enter:
    trcstop
    After the trcstop command is issued, the I/O activity report is displayed on standard output (but probably scrolls off the screen). The virtual memory I/O report is limited to the 20 segments that incurred the most I/O.
  2. To monitor the activity at all file system levels, and write the report to the fmon.out file, enter:
    filemon -o fmon.out -O all
    The filemon command automatically starts the system trace and puts itself in the background. After this command, enter the application programs and system commands to be run at this time, then enter:
    trcstop
    After the trcstop command is issued, the I/O activity report is written to the fmon.out file. All four levels of the file and I/O system (the logical file, virtual memory, logical volume, and physical volume levels) are monitored. The logical file and virtual memory I/O reports are limited to the 20 files and segments (respectively) that incurred the most I/O.
  3. To monitor the activity at all file system levels and write a verbose report to the fmon.out file, enter:
    filemon -v -o fmon.out -O all
    The filemon command automatically starts the system trace and puts itself in the background. After this command, enter the application programs and system commands to be run at this time, then enter:
    trcstop
    This example is similar to the previous example, except a verbose report is generated on the fmon.out file. The primary difference is that the filemon command indicates the steps that it is taking to start the trace, and the summary and detailed reports include all files and segments that incurred any I/O (there might be many), instead of just the top 20.
  4. To report on I/O activity captured by a previously recorded trace session, enter:
    filemon -i trcfile | pg
    In this example, the filemon command reads file system trace events from the input file trcfile. Since the trace data is already captured on a file, the filemon command does not put itself in the background to let application programs run. After the entire file is read, an I/O activity report for the virtual memory, logical volume, and physical volume levels will be displayed on standard output (which, in this example, is piped to pg).
  5. To monitor the I/O activity for logical and physical volumes only, while controlling the monitored intervals using the trcon and trcoff commands, enter:
    filemon -d -o fmon.out -O pv,lv
    The filemon command automatically starts the system trace and puts itself in the background. After this command, you can enter the unmonitored application programs and system commands to be run at this time, then enter:
    trcon
    After this command, you can enter the monitored application programs and system commands to be run at this time, then enter:
    trcoff
    After this command, you can enter the unmonitored application programs and system commands to be run at this time, then enter:
    trcon
    After this command, you can enter the monitored application programs and system commands to be run at this time, then enter:
    trcstop
    In this example, the -O flag is used to restrict monitoring to logical and physical volumes only. Only those trace events that are relevant to logical and physical volumes are enabled. Also, as a result of using the -d flag, monitoring is initially deferred until the trcon command is issued. System tracing can be intermittently disabled and reenabled using the trcoff and trcon commands, so that only specific intervals are monitored.
  6. To run filemon in offline mode, run the trace and gensyms commands separately, then use the output from those commands as input to the filemon command, as follows:
    trace -a -T 768000 -L 10000000 -o trace.out -j 000,000,001,002,003,
    005,006,139,102,10C,106,00A,107,101,104,10D,15B,12E,130,163,19C,154,
    3D3,1BA,1BE,1BC,10B,221,1C9,222,228,232,45B
    Run the monitored application programs and system commands, then enter:
    trcstop
    Create the gensyms file:
    gensyms -F > gensyms.out
    Then run filemon with both -i and -n flags:
    filemon -i trace.out -n gensyms.out -O all
  7. To generate hotness report in automated offline mode, with unit of data as megabytes, use the following command:
    filemon -O hot,unit=MB -r <rootstring> -A-x "<user command>" 
  8. To generate hotness report with three snapshots of trace in 5-seconds interval, run the following command:
    filemon -O hot -r <rootstring> -A-x "<user command>" -I 3:5
  9. To generate hotness report in offline mode:
    filemon -r <rootstring> -O hot