Once a database is attached, the service takes a reading of it every round — 60 seconds by default. sloop service activity is those readings, added up.

What it records

Per database, per UTC day. That single choice is why the screen can show three windows without storing three things: a day, a week, a month and a year are all a sum over a range of days, and the range is the only difference between them.

UTC rather than local, for the reason backups are named in UTC: a day that changes length twice a year is a day that makes two months incomparable.

rows in: Rows written into the database over the period.; The engine's own counters, read once a round and differenced. sloop does not count them itself.
rows out: Rows read out of it over the period.; The same counters, the same way.
readings: How many rounds the service actually sampled in that period.; A count of samples. It is shown because a window with two readings and a window with two thousand are not the same evidence.
Size: How much space the database takes on disk, and when that was last read.; The engine's own size functions, at the moment of the last reading.
Moved: Bytes sloop itself read or wrote, over 30 days.; sloop read the dump and wrote the restore, so it knows exactly how many. This is the only figure on the screen sloop measures directly — which is why it is a line of its own rather than a column beside the rows.

What it does not record, and says so

sloop does not measure network traffic

Bytes on the wire are not available per database on PostgreSQL, MySQL or MariaDB. No engine reports them. So sloop does not show a figure for them — not an estimate, not a derived number, not a zero. It says the sentence instead, on the screen itself, every time.

Moved is the closest thing to it and is deliberately not called bandwidth: it is bytes sloop itself read or wrote during a dump or a restore. sloop did that reading and writing, so it knows the number exactly. It is a line of its own under a word of its own, and it is never added to the row counts — they measure different things in different units.

A period with no readings is not a period with no activity

If the service was not running, nothing was watched, and sloop will not write 0 in a space where the honest answer is nobody was looking. That window says no readings in this period instead — a zero there would be a claim about the database, when the only true claim is about the service.

Before a service has run

Which is where every machine starts, and the screen is candid about it:

nothing attached

$ sloop service activityActivity nothing is attached — `sloop service attach <name>` attaches a database

attached, never sampled

$ sloop service activityActivity 2 databases attached analytics  nothing recorded yet — attached 2026-09-19 21:06:26 +06:00  no running service has picked it up yet orders  nothing recorded yet — attached 2026-09-19 21:06:26 +06:00  no running service has picked it up yet   rows are what the server counted; Moved is real bytes sloop read or wrote. Nothing  here is bytes on the wire — no engine reports those per database.  no service has ever read this list — `sloop service install` starts one

nothing recorded yet and no running service has picked it up yet are two different facts, and both are printed. Attaching a database does not record anything — installing and starting the service is what does.

Once it has been running

The numbers below are invented. Every other block on this site is a real run; this one is the layout with made-up figures in it, because activity rows are written only by an installed, running service and this documentation was not going to install one on somebody's machine to take a picture. Every word, label and unit is sloop's own.

illustrative — not a capture

$ sloop service activityActivity 2 databases attached analytics  Today   4,102 rows in · 61,330 out · 288 readings  7 days  26,884 rows in · 402,551 out · 2,016 readings  30 days 119,470 rows in · 1,744,902 out · 8,640 readings  Size    412.6 MiB on disk, read 2026-09-19 21:04:12 +06:00 orders  Today   no readings in this period  7 days  71,205 rows in · 84,330 out · 1,728 readings  30 days 284,902 rows in · 341,770 out · 8,352 readings  Size    1.4 GiB on disk, read 2026-09-19 21:04:12 +06:00  Moved   3.1 GiB in · 0 B out · real bytes sloop moved, over 30 days   rows are what the server counted; Moved is real bytes sloop read or wrote. Nothing  here is bytes on the wire — no engine reports those per database.  the service last read this list at 2026-09-19 21:04:12 +06:00

Three windows per database, in the same column so two lines can be compared by eye. Counts are grouped, not shortened — 1,744,902 rather than 1.7M, because on a screen you are using to decide whether a database is being hammered, the difference between 1,700,000 and 1,749,999 is the difference you came for.

orders above shows both halves of the honesty. Its week and month are populated and today is not — the service stopped this morning, so there is nothing to report for today and sloop says that rather than writing 0. Note which window is the empty one: thirty days contains the seven, so a populated week inside an empty month is a screen sloop could never print. And orders has a Moved line where analytics does not, because it is the one that has been backed up.

A database that is detached but still has history is listed under still recorded but no longer attached rather than dropped — detaching stops the watching, it does not delete what was watched.

service status is the other half of this: attached, scheduled, last run, next run. Both are on the command reference with every flag they take.