filetop-rs

Real-time per-file read/write top view, powered by eBPF. Lists the hottest files by I/O bytes, like top for file activity. Modelled after bcc/tools/filetop but written in Rust with libbpf-rs.

Quick Start

sudo ./target/release/filetop-rs

Then use:

• j / k to move between rows
• gg / G to jump to the top or bottom
• / to search by PID, command, or file name
• s to export the current snapshot to /tmp/

Example session:

Requirements

• Linux with BTF available at /sys/kernel/btf/vmlinux
• root, or sufficient BPF-related capabilities for your environment
• clang for building the BPF program
• Rust stable toolchain

Quick check:

ls -l /sys/kernel/btf/vmlinux

Build

cargo build --release

Binary:

target/release/filetop-rs

Usage

Whole system:

sudo ./target/release/filetop-rs

Trace a single PID:

sudo ./target/release/filetop-rs --pid 1234

Use a 5 second refresh interval:

sudo ./target/release/filetop-rs --interval 5

Remove inactive rows after 10 seconds:

sudo ./target/release/filetop-rs --purge-after 10

Start sorted by write bytes:

sudo ./target/release/filetop-rs --sort write

CLI Options

Flag	Default	Description
-p, --pid <PID>	-1	Trace only this PID; -1 means whole system
-i, --interval <SEC>	2	Refresh interval in seconds
--purge-after <SEC>	30	Remove inactive rows after this many seconds
-s, --sort <KEY>	read	Initial sort key: read, write, reads, writes, pid, comm, file

Keyboard Shortcuts

Key	Action
q, Esc, Ctrl+C	Quit
?	Toggle help
/	Start search
Enter	Apply search
Esc	Cancel search input or clear active filter
j / k	Move selection down / up
Up / Down	Move selection down / up
Ctrl+D / Ctrl+U	Half-page down / up
gg / G	Jump to top / bottom
r / w	Sort by read / write bytes
R / W	Sort by read / write operations
p / c / t	Sort by PID / command / file
Tab	Reverse sort direction
s	Export current pool to CSV under /tmp/

Mouse support:

• wheel scroll moves selection
• clicking a header sorts by that column
• clicking a row selects it

CSV Export

Press s to export the current pool to a CSV file under /tmp/:

/tmp/filetop-rs-<unix_ts>.csv

The exported CSV includes:

• pid
• inode/dev
• command
• file name
• cumulative read/write bytes
• cumulative read/write operations
• total bytes
• whether the row is dimmed

Row Lifecycle

Rows stay visible for a short time after activity stops:

• if a row has no activity in the next refresh, it becomes dimmed immediately
• dimmed rows remain in the table until --purge-after
• once that timeout expires, the row is removed

This is useful for spotting short bursts of file activity without losing them instantly.

Search and Sorting

Search matches these fields:

• PID
• process name (COMM)
• file name (FILE)

Matching is case-insensitive for text fields.

Sorting is applied to the currently visible set, and filtering happens before sorting to keep large filtered views responsive.

Notes and Limitations

• The FILE column is a basename-style name captured from the dentry, not a full absolute path
• Stats are per (pid, inode, dev), so the same file touched by different processes appears as separate rows
• Counters are request-oriented, not confirmed physical disk bytes
• As with similar probe-based tools, edge cases like short I/O or failed I/O may affect exact accounting

License

MIT