filetrace processes: network activity per process

Reference for filetrace processes: outbound rate, files sent, open connections and byte totals per process, with every option, examples and exit codes.

filetrace processes lists the processes with network activity: how fast each is sending now, how many distinct files it has sent, how many connections it has open and how many bytes it has sent and received. Rows are ordered by outbound rate, then by bytes sent, so the processes sending now come first.

​

Usage

filetrace processes [options]

​

What it shows

sudo filetrace processes --limit 8

PID   PROCESS          OUTBOUND  FILES  CONNECTIONS     SENT  RECEIVED
1024  file-server     4.04 MB/s      1            2  15.5 MB       0 B
1014  file-server         0 B/s      1            0  47.7 MB       0 B
1018  file-server         0 B/s      1            0  11.4 MB       0 B
1016  file-server         0 B/s      1            0  7.63 MB       0 B
1020  file-server         0 B/s      0            0   195 KB       6 B
1022  file-server         0 B/s      0            1  48.8 KB       0 B
152   metrics-daemon      0 B/s      0            1    473 B       0 B
1021  file-server         0 B/s      0            0      6 B    195 KB

Observed since 2026-11-11 20:07:55. History is not kept across agent restarts.

Column	Meaning
PID	The process ID
PROCESS	The process name
OUTBOUND	The rate at which the process is sending now, in bytes per second over the last one to two seconds
FILES	The distinct files it has sent; a file sent over several sockets counts once
CONNECTIONS	Its open sockets
SENT	Bytes its sockets accepted since the agent started observing it
RECEIVED	Bytes its sockets delivered to it

A process is listed once it has sent or received bytes or holds an open socket. Processes that have exited stay listed while the agent remembers them; machine-readable output gives their status as exited.

​

Options

--active-only · boolean

Only running processes with at least one open connection.

--include-children · boolean

Add each process’s descendants to its totals: bytes, rates, connections, files and transfers.

--pid · number

Only this process.

--process · string

Only processes with this name. * matches any run of characters. Alias: --name.

--user · string

Only processes of this user, by name or numeric ID.

--cgroup · string

Only processes in this cgroup, by numeric ID or cgroup directory.

--namespace · number

Only processes in this network, PID or mount namespace, given as the inode number that ls -Li /proc/<pid>/ns shows.

--since · string

Only processes active at or after this time: a duration such as 10m, 1h or 7d, or an RFC 3339 timestamp.

--until · string

Only processes that started at or before this time.

--sort · string

outbound, inbound, connections, bytes, time, pid or process. outbound and inbound order by the current rate, then by bytes; bytes orders by bytes sent and received together; time by the most recent activity.

--limit · number

Show at most this many rows.

--format · string · default: "table"

table, json, jsonl, csv or quiet. Quiet prints one process ID per row.

--json · boolean

Short for --format json.

--jsonl · boolean

Short for --format jsonl.

--output · string

Write to this file instead of standard output.

Byte counts cover a record’s whole observed lifetime; --since and --until select which records are listed. See filters and output formats.

​

Examples

filetrace processes --sort outbound
filetrace processes --name nginx --include-children
filetrace processes --format csv > processes.csv

Machine-readable output adds the parent, user, executable, transfer counts, start time, status, cgroup and namespaces of each process:

sudo filetrace processes --json --limit 2

[
 {"pid":1024,"ppid":772,"name":"file-server","user":"root","uid":0,"gid":0,"executable":"/usr/local/bin/file-server","bytes_sent":16250000,"bytes_received":0,"bytes_sent_per_second":4227370,"bytes_received_per_second":0,"connections":2,"files":1,"transfers":1,"active_transfers":1,"started":"2026-11-11T20:07:56.180Z","status":"running","cgroup_id":631,"pid_namespace":4026531836,"mount_namespace":4026532557,"network_namespace":4026532561},
 {"pid":1014,"ppid":772,"name":"file-server","user":"root","uid":0,"gid":0,"executable":"/usr/local/bin/file-server","bytes_sent":50000000,"bytes_received":0,"bytes_sent_per_second":0,"bytes_received_per_second":0,"connections":0,"files":1,"transfers":1,"active_transfers":1,"started":"2026-11-11T20:07:56.052Z","status":"exited","cgroup_id":631,"pid_namespace":4026531836,"mount_namespace":4026532557,"network_namespace":4026532561}
]

To see one process in full, with its top destinations and the files it sent, use inspect process. top ranks the processes by outbound traffic.

​

Exit codes

Code	Meaning
0	Success
1	General error
2	Invalid arguments
3	Permission denied: the agent socket is not accessible to this user
4	No agent is running
5	Unsupported platform or capability
6	The configuration file cannot be read or is invalid
9	Partial results: events were lost in the queried time range