> ## Documentation Index > Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # filetrace top: rank processes, files and destinations > Reference for filetrace top: rank processes, files, remote addresses or connections by bytes sent, with the columns of each subject and the options. `filetrace top` ranks what sends the most: processes (the default), files, remote addresses or connections. It prints the ten highest by default, numbered by rank, and takes the same time filters as the listing commands. ## Usage ```bash theme={null} filetrace top [processes|files|destinations|connections] [options] ``` ## Subjects | Subject | Ranks | Ordered by | | - | - | - | | `processes` | Processes that have sent at least one byte | Outbound rate, then bytes sent | | `files` | Files, with their transfers merged | Bytes sent | | `destinations` | Remote addresses, with their flows merged | Bytes sent | | `connections` | Flows: one process's traffic with one remote endpoint on a socket | Bytes sent | In a table, a heading line names the ranking, such as `TOP PROCESSES BY OUTBOUND TRAFFIC`, and the first column is the RANK. ### Processes ```bash theme={null} sudo filetrace top ``` ```text theme={null} TOP PROCESSES BY OUTBOUND TRAFFIC RANK PID PROCESS OUTBOUND FILES CONNECTIONS SENT RECEIVED 1 1024 file-server 4.01 MB/s 1 2 15.5 MB 0 B 2 1014 file-server 0 B/s 1 0 47.7 MB 0 B 3 1018 file-server 0 B/s 1 0 11.4 MB 0 B 4 1016 file-server 0 B/s 1 0 7.63 MB 0 B 5 1020 file-server 0 B/s 0 0 195 KB 6 B 6 1022 file-server 0 B/s 0 1 48.8 KB 0 B Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` The columns are those of [`processes`](https://filetrace.mintlify.site/cli/processes). ### Files ```bash theme={null} sudo filetrace top files ``` ```text theme={null} TOP FILES BY BYTES SENT RANK FILE SENT TRANSFERS CONFIDENCE 1 /srv/export/media/files/video.mp4 47.7 MB 1 EXACT 2 /srv/export/media/files/stream.bin 15.5 MB 1 EXACT 3 /srv/export/media/files/customers.csv 11.4 MB 1 INFERRED 4 /srv/export/media/files/backup.tar.gz 7.63 MB 1 EXACT Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` SENT adds up the bytes of all transfers of the file, TRANSFERS counts them, and CONFIDENCE is the lowest level among them: a file sent once with `sendfile` and once by a read-write loop shows `INFERRED`. Bytes that no file accounts for are not ranked. A file whose path is not known shows as `(device inode )`. ### Destinations ```bash theme={null} sudo filetrace top destinations ``` ```text theme={null} TOP DESTINATIONS BY OUTBOUND TRAFFIC RANK REMOTE SENT RECEIVED FLOWS 1 127.0.0.1 74.9 MB 73.4 MB 9 2 ::1 7.63 MB 5.92 MB 2 3 192.168.65.1 473 B 0 B 1 4 * 0 B 48.8 KB 1 Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` Each row is one remote address, with the bytes sent to it and received from it over all flows and the number of flows. `*` collects flows without a remote end, such as a UDP socket that only receives. ### Connections ```bash theme={null} sudo filetrace top connections ``` ```text theme={null} TOP CONNECTIONS BY OUTBOUND TRAFFIC RANK PID PROCESS PROTOCOL LOCAL REMOTE SENT RECEIVED OUTBOUND FLOW 1 1014 file-server TCP 127.0.0.1:43090 127.0.0.1:34477 47.7 MB 0 B 0 B/s 12 2 1024 file-server TCP 127.0.0.1:41814 127.0.0.1:51871 15.5 MB 0 B 4.00 MB/s 7 3 1018 file-server TCP 127.0.0.1:60088 127.0.0.1:52535 11.4 MB 0 B 0 B/s 8 4 1016 file-server TCP [::1]:55572 [::1]:46399 7.63 MB 0 B 0 B/s 5 5 1020 file-server TCP 127.0.0.1:49084 127.0.0.1:40477 195 KB 6 B 0 B/s 4 Observed since 2026-11-11 20:07:55. History is not kept across agent restarts. ``` The columns are those of [`flows`](https://filetrace.mintlify.site/cli/flows); FLOW is the ID that [`inspect flow`](https://filetrace.mintlify.site/cli/inspect) takes. ## Options **--pid** `number` Only this process. **--process** `string` Only processes with this name. `*` matches any run of characters. Alias: `--name`. **--protocol** `string` (default: all) Only this protocol: `tcp`, `udp` or `all`. Accepted by the `files`, `destinations` and `connections` subjects; `top processes` does not take it. **--since** `string` Only records active at or after this time: a duration such as `10m`, `1h` or `7d`, or an RFC 3339 timestamp. **--until** `string` Only records that started at or before this time. **--limit** `number` (default: 10) Number of rows. **--format** `string` (default: table) `table`, `json`, `jsonl`, `csv` or `quiet`. Quiet prints the process ID, file path, remote address or flow ID of each row, depending on the subject. **--json** `boolean` Short for `--format json`. **--jsonl** `boolean` Short for `--format jsonl`. **--output** `string` Write to this file instead of standard output. The heading line is left out. Byte counts cover a record's whole observed lifetime; `--since` and `--until` select which records are ranked. Machine-readable formats carry exact byte counts and RFC 3339 timestamps, and leave out the rank: the order of the records is the ranking. For `files` the fields are `file`, `bytes_sent`, `transfers` and `confidence`; for `destinations` they are `remote_ip`, `bytes_sent`, `bytes_received` and `flows`; `processes` and `connections` print the records of `processes` and `flows`. ## Examples ```bash theme={null} filetrace top filetrace top files --since 1h filetrace top destinations --protocol tcp --limit 20 ``` ## Exit codes | Code | Meaning | | - | - | | 0 | Success | | 1 | General error | | 2 | Invalid arguments, including an unknown subject | | 3 | Permission denied: the agent socket is not accessible to this user | | 4 | No agent is running | | 5 | Unsupported platform or capability | | 6 | The configuration file cannot be read or is invalid | | 9 | Partial results: events were lost in the queried time range | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.