cfilt [-p] [-aN] -f<input file> expression[ expression[ ...]]
select only the samples that contain process data. This is useful when a separate process interval was given to 'collect', such as '-i1,4', but you want to graph process data against some non-process data, such as cpu idle (or anything, really). average values for N of samples
cfilt allows the arbitrary selection of values from the output of collect. It condenses the output of collect into 1 line per sample, or per N samples, if using the -a flag to average N samples. The data in this form can then be graphed using gnuplot or excel (yuck).
An expression has the following syntax: <subsystem>:<selection-criterion>:<tag-expr1>:<tag-expr2>:<...>:<tag-exprN> subsystem
can be one of: proc, disk, tape, mem, net, cpu, sin, file, tty, lsm, and message-queue (first 3 chars are significant)
if a plus-sign '+' is on the end, or no selection-criterion
has been given, then numerical values are summed for all
lines of a subsystem. If a selection-criterion has been
provided, and there is no plus-sign on the end of the
subsystem-name, then for each value in the selection-criterion,
the corresponding values for each <tag-expr> will be printed.
For example, given the following output from collect:
# DISK Statistics
#DSK NAME B/T/L R/S RKB/S W/S WKB/S AVS QLEN %BSY
0 rz1 0/1/0 5 300 10 1000 10 0 70
1 rz2 0/2/0 7 400 11 2000 10 0 80
2 rz3 0/3/0 9 500 12 3000 10 0 90
Assuming that cfilt is called with the single following expression, "disk:r/s" would sum reads/second for all disks. That is, 5+7+9=21. The output of cfilt would be: <time> <sample#> 21 "disk+:name=rz1,rz2:r/s" would sum reads/second for disks rz1 and rz2, 5+7=12. ("name=rz1,rz2" is a selection-criterion, which is discussed below.) The output of cfilt would be: <time> <sample#> 12 "disk+:name=rz1,rz2:rkb/s+wkb/s" would sum KiloBytes read and written for disks rz1 and rz2, 300+400+1000+2000=3700, as follows ("rkb/s+wkb/s" is a "tag-expression", which is discussed below.): <time> <sample#> 3700 "disk:name=rz1,rz2:r/s" would print reads/second for rz1 and reads/second for rz2, as follows: <time> <sample#> 5 7
A selection-criterion is a field tag (see "tag-expr") on the left of an equals-sign, and a comma-separated list of values in that field that should be selected. <tag>=<value>[,<value>[,<value>[...]]] examples: "pid=1234,1235,8888", "command=init", "name=rz0,rz1"
tags are the column-labels used by 'collect', for example, in the disk subsystem, the tags are 'dsk', 'name', 'b/t/l', 'r/s', and so on. A tag-expr can be anything from a complicated arithmetic expression to simply the name of a collect output field, such as "rss".
arithmetic expressions: add values tag1 and tag2 subtract multiply divide tag1 by tag2 functions constants and grouping
If division (~) is being used, cfilt invokes a special mechanism to trap division-by-zero, therefore the ugly, nasty construction "tag1~(tag2+0.01)" is no longer necessary.
If a hash sign '#' is appended to the <tag-expr>, all values are normalized to 100, or if an integer follows the '#', then it is used instead of 100. This is useful for graphing results simultaneously.
Furthermore, an additional simple arithmetic expression can be appended to the normalization directive ('#' or '#<num>'), which will be evaluated AFTER the normalization is done. For example:
will normalize, in the first example to 100, in the second to 200 all KiloBytes-read-per-second, and THEN add 100 to the normalized value for each sample. This expression may not contain any column-labels, therefore you may not use:
The available functions are: cos, sin, tan, sqrt, log, exp, abs, atan2, int, and convtime for converting Minutes:Seconds.TenthsHundreths to Seconds.TenthsHundreths.
If subsystem has multiple lines/sample, values are added for all lines that match in one record. (if no 'selection-critieron', then all are taken)
NOTE: No white space is allowed in expressions! If using parenthesis for grouping or functions, be sure to surround the expression in single-quotes "'". You can only give ONE expression per subsystem to cfilt. Giving more will only confuse it (and you). This means, among other things, that you can't have summed data for a subsystem and individual graphs for all the things you summed (sob...). The first two columns of output are always <time> <sample-number>, where <time> is in the format YY:MM:DD:HH:MM:SS.
cfilt -fdata.in cpu:user+nice:intr#:sysc#:cs# <time> <sample#> <user+nice> <interrupts> <syscalls> <conswitch> (where interrupts,syscalls,conswitch are normalized) cfilt -fdata.in proc+:user=urban:rss <time> <sample#> <RSS (resident set size) for all processes owned by urban> cfilt -fdata.in cpu:idle net:inpkt+outpck# mem:free# <time> <sample#> <cpu:idle> <net:inpck+outpck(normalized)> <mem:free(normalized)> cfilt -fdata.in pro:pid=1234,8888:rss:vsz <time> <sample#> <rss(pid=1234)> <vsz(pid=1234)> <rss(pid=8888)> <vsz(pid=8888)> cfilt -fdata.in pro+:pid=1234,8888:rss:vsz <time> <sample#> <rss(sum for pid 1234,8888)> <vsz(sum)> cfilt -fdata.in pro+:rss:vsz <time> <sample#> <rss(sum all procs)> <vsz(sum for all procs)>