Peak loads, I/O issues, and inexplicable system behavior pose problems for administrators day after day. Why is the database using so much swap memory? Why is my laptop battery discharging so quickly? The legacy command-line utility Top specializes in problems like these.

Top was the first in a long line of self-refreshing resource monitoring tools. Now numerous imitators vie for the administrator's attention. With the help of a Linux Magazine jury, we tried out dozens of wannabe top performers, and now proudly present the top 10 Tops.

The top tools in this category – with one exception – all have one thing in common: They display the resources used by a service or a server in a syntax that is reminiscent of the legendary Unix Top utility. The rankings here are based on how useful the tool is for troubleshooting.

10: Xrestop

Xrestop [1] shows X11 users which X client programs are using the most resources, organizing the results neatly by pixmap memory usage (Figure 1). The tool relies on the X resource extension [2] to query information on the clients connected to the X server. The XResQueryClients, XResQueryClientResources, and XresQueryClientPixmapBytes functions provide the data from which Xrestop generates a Top-style view.

Figure 1: Xrestop shows the pixmap memory usage for the active X11 applications. The screenshot was taken with KSnapshot, which explains why the KSnapshot tool is on top of the list.

Xrestop was originally designed by the X.org community to help developers locate memory or performance holes in the X server, but in the course of time, it has gained popularity as a daily administration tool. Admins today often use Xrestop to locate undesirable resource killers. Although you can locate a crashed or hanging X Window application easily, you will need to use another tool to kill the culprit. Because Xrestop only helps you troubleshoot issues with X applications and does not offer much in the line of options, the tool just scrapes into 10th place on the list.

9: Ntop

Ntop [3] is a popular instant monitoring tool that gives the admin an overview of the network interface card, its throughput, and all of its connections. The mass of information that Ntop collects and presents in its neat web interface guarantees a top 10 spot for the 10-year-old Ntop project. Figure 2 shows just some of the statistics that Ntop collects.

Figure 2: At what time is the VPN server busiest? Ntop answers this question and more with its neat web interface.

The tool shows the admin details of network connections on an interface, sorting them by time, host, protocol, or various other options. Clear RRD-based diagrams give administrators an at-a-glance view of unusual goings on.

Although you don't need to customize Ntop before you start, the information it collects is volatile and disappears completely if you restart. A workaround for this is to use Ntop with a database back end, although this solution will entail far more configuration.

Until recently, Ntop also included the Intop command-line tool, which displays a continually updated Top-style view of the current network connections. The Intop tool, however, is missing from recent versions of Ntop. According to Ntop developer Luca Deri, the next version of Ntop will include the far more comprehensive Packet Shell (Pksh [4]). But until it is released, Ntop does not offer a command-line client.

Thus, despite its enormous feature set, the excellent web interface, and the scope of the information it collects, Ntop comes in at number nine.

8: ApacheTop

ApacheTop [5] is a lean tool that offers information on current Apache web server access, the pages Apache serves up, the number of hits per second, and many other statistics. The helper application finds the necessary information in Apache's access_log files (Figure 3).

Figure 3: A web server under investigation by ApacheTop: A user is currently accessing SquirrelMail.

Some options change the appearance of the queries: -q keeps the query strings used by, for example, PHP scripts, -l forces lower case, and -s number defines the number of numeric sections in the URL. Finally, -r resolves host names to their matching IPs.

A web administrator can use the command line to tell ApacheTop how long to keep statistics before refreshing and deleting them. To do this, you can define a number of hits (-H Hits) or specify a value in seconds (-T seconds), as well as set the delay between two refreshes (-d seconds).

The tool loses a couple points because it is fairly ancient and has not been developed actively since 2005. Despite the drawbacks, administrators who have installed Fam and Portmap on their web servers will find ApacheTop a practical live analysis tool for Apache, with many applications in production use.

Unfortunately, the feature scope is restricted to command-line options, which makes it hard for ApacheTop to keep pace with some of its more feature-rich competitors.